Remove user password (to prevent ssh login using password).

[martin_]

How to remove a user's password and thus block that user from logging in with ssh (I use a key to log in)? I tried it to be empty, but a funny thing happens - it lets me in with no password.

 

[fonz]

How to remove user password and thus block user from log[red]g[/red]ing to [red]in with[/red] ssh (i[red]I[/red] use key to log in)?

Use vipw(8) to set the user's password to "*", as in this example:

fonz:[b][red]*[/red][/b]:1001:10000::0:0:A.J. "Fonz" van Werven:/home/fonz:/bin/tcsh

I tried it to be empty, but funny thing happens - it lets me in with no password.

Of course it does. That's normal behaviour.

 

[martin_]

Thanks both fonz for perfect answer (it worked exactly like I expected) and DutchDaemon for perfect grammar (I am emulated speaker (non-native :stud), working on my English every day!).

 

[fluca1978]

Please consider that OpenSSH has specific options for AllowUsers and DenyUsers.

 

[fonz]

Please consider that OpenSSH has specific options for AllowUsers and DenyUsers.

Also look at PasswordAuthentication and ChallengeResponseAuthentication, to be found in /etc/ssh/sshd_config and explained in the manpage sshd_config(5).

 

[kpa]

The most safe option to disable an account is to use pw(8):

# pw usermod name -h -

If a value of ‘-’ is given as the argument fd, then the
password will be set to ‘*’, rendering the account inacces‐
sible via password-based login.

 

[fonz]

# pw usermod name -h -

That essentially does the same as my vipw(8) solution except that it's a single command and therefore a bit less error-prone than editing /etc/master.passwd, provided that one can remember the exact pw(8) syntax, which many find challenging

 

[kpa]

Remembering that a star in the password field represents a disabled account can be equally challenging

 

[martin_]

Thanks for detailed expertise. For me both answers are quite challenging, so all I will remember is that I asked this question here..

 

[johnd]

Why not just use

# pw lock name
# pw unlock name

Very easy to remember.

 

[fluca1978]

Why not just use

# pw lock name
# pw unlock name

Very easy to remember.

Not sure but the question was to prevent the user to log in via ssh, so I guess the account should not be locked at all. Anyway all this thread is full of a set of options that allows the author to do nearly everything he wants with the accout.

 

[fonz]

Not sure but the question was to prevent the user to log in via ssh,

No, the question was to prevent the user from logging in using a password and to only allow logging in over SSH using a keyfile.

 

[fluca1978]

No, the question was to prevent the user from logging in using a password and to only allow logging in over SSH using a keyfile.

Then locking the account is not the answer, tweaking the sshd_config is.
Again, the user now has enough information to do what he wants.