First, I want to be clear, I am not asking about just using public key authentication without a prompt. I have a use case where a user must only be allowed access through SSH public key authentication. Logging in via password on a serial terminal is something I want disabled for this user. I am building my own linux kernel, so the user is created with a home directory that contains an authorized_keys file. In /etc/shadow, the user has an entry with no password: <username>:!:...
.
My sshd_config contains PasswordAuthentication no
, PermitEmptyPasswords yes
but even still the user is denied with the correct private key identity file matching that user's ~/.ssh/authorized_keys file. UsePAM no
is not supported by this version of the SSH server (at least that is what is reported). All ownership and permissions on the user's files/folder server-side have been validated.
After looking at what I think is the openSSH server (sshd) code, it checks for a locked account in the /etc/shadow password file:
https://github.com/openssh/openssh-portable/blob/V_7_4_P1/auth.c#L141
This leads me to believe that it is folly to try it this way, I should set a password and disable serial logins another way.
This makes intuitive sense but I wanted to get confirmation that the kernel (and openssh) is designed to not allow a user to log in unless as password has been set. Is there any official documentation or word on this? Thanks in advance.