First, I want to be clear, I am not asking about just using public key authentication without a prompt. I have a use case where a user must only be allowed access through SSH public key authentication. Logging in via password on a serial terminal is something I want disabled for this user. I am building my own linux kernel, so the user is created with a home directory that contains an authorized_keys file. In /etc/shadow, the user has an entry with no password:
My sshd_config contains
PermitEmptyPasswords yes but even still the user is denied with the correct private key identity file matching that user's ~/.ssh/authorized_keys file.
UsePAM no is not supported by this version of the SSH server (at least that is what is reported). All ownership and permissions on the user's files/folder server-side have been validated.
After looking at what I think is the openSSH server (sshd) code, it checks for a locked account in the /etc/shadow password file:
This leads me to believe that it is folly to try it this way, I should set a password and disable serial logins another way.
This makes intuitive sense but I wanted to get confirmation that the kernel (and openssh) is designed to not allow a user to log in unless as password has been set. Is there any official documentation or word on this? Thanks in advance.