I would like to create a user and have no password. As in you can't log in with a password. I want to add keys to its authorized_keys by using root. This is for my automated backup system.


Use of passwd -d is plain wrong , at least on Fedora, on any linux distro based on shadow-utils. If you remove the password with passwd -d, it means anyone can login to that user (on console or graphical) providing no password.

In order to block logins with password authentication, run passwd -l username, which locks the account making it available to the root user only. The locking is performed by rendering the encrypted password into an invalid string (by prefixing the encrypted string with an !).

Any login attempt, local or remote, will result in an "incorrect password", while public key login will still be working. The account can then be unlocked with passwd -u username.

If you want to completely lock an account without deleting it, edit /etc/passwd and set /sbin/nologin or /bin/false in the last field. The former will result in "This account is currently not available." for any login attempt.

Please refer to passwd(1) man page.

  • @guido: rvs won't be notified of your answer. You would need to add a comment to his answer for that (I've done it). Note that readers may read your answer before his, you should write answers that respond directly to the question. Well done for pointing this one out! It applies to most Linux distributions (the ones using the Linux shadow utilities). – Gilles 'SO- stop being evil' Feb 18 '11 at 22:39
  • @Gilles: sorry i am new to stackexchange; i only pointed out this one a bit hardly because it was like suggesting users to setup passwordless accounts, and it was accepted and marked as useful... – guido Feb 18 '11 at 22:42
  • @guido: No worries, I was just explaining how to make your warning more effective. In fact, in such extreme cases where an answer is dangerously wrong, it would be appropriate to suggest an edit adding a warning or correction (hopefully you won't encounter these situations too often on the site). – Gilles 'SO- stop being evil' Feb 18 '11 at 22:58
  • @guido: Actually, on debian Squeeze (i dont know about lenny or etch) that answer DOES work. It doesnt allow anyone but root to log in, allows authorize keys but it isnt password less, it just accepts no password. I was surpised you could 'delete the password' and that it would work this way. But it did exactly what i wanted and exactly what this answer does and was the only answer so i just accepted it. This answer makes more sense and i'll accept it because i'm willing to bet other distos does allow anyone to login bc its passwordless unlike debian. Anyways good answer. – user4069 Feb 20 '11 at 2:05
  • 1
    @acidzombie24, @mattdn: they could have removed nullok from pam.d/password-auth if debian uses pam (i think so, but i am not a debian expert). However, passwd(1) manpage cleary states that -d argument is to create passwordless accounts, so any distro-specific speculation here is secondary, as the question was very general. – guido Feb 20 '11 at 22:00

Are not you asking specific to SSH daemon, not to accept the password based authentication but the key/passphrase authentication?

Look for changes to sshd_config.


PasswordAuthentication No
PreferredAuthentications publickey,hostbased,keyboard-interactive
Protocol 2,1

Look for more config parameters at man ssh_config


Just don't set password for user. If there is already a password remove it by using passwd -l <username>.

But it would be still possible to log in as this user - by using authorized_keys, or via su or sudo from some privileged account.

  • 1
    As pointed out by guido, passwd -d makes the account passwordless, as in, you can log in without having to type a password. Use passwd -l to lock the account (think of it as giving an impossible-to-type password). – Gilles 'SO- stop being evil' Feb 18 '11 at 22:34
  • I've added a warning to your post, because it is dangerous as it stands. I'll leave it up to you to decide whether to fix your answer, or delete your answer (if you think guido's is sufficient), or refute the warning. – Gilles 'SO- stop being evil' Feb 18 '11 at 22:37
  • Why oh why do people accept the answer that doesn't even work? – mathepic Feb 18 '11 at 23:47
  • @mathepic: It does work, on debian. Exactly the way i asked – user4069 Feb 19 '11 at 1:14
  • are you sure that a non-privileged user can't su to the user? – mattdm Feb 20 '11 at 15:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy