2

I am adding a new user account (to a CentOS 6.2 box) which will only use ssh key authentication (with a strong key passphrase of course). I have disabled ssh password auth in sshd_config.

Should I even use passwd to setup a password for them? Is there a security issue not creating a password?

3 Answers 3

2

No, you don't need a password if you will be only using SSH key authentication.

Even, if you set a password for this user, you can disable password authentication in sshd_config for specific users/groups.

2
  • 3
    You should also make sure null passwords are disabled in PAM configuration if you use empty passwords and don't want users to be able to login with username only. Jun 25, 2012 at 12:08
  • I personnaly create my user accounts with 'adduser --disabled-password' (this is Debian specific), which makes sure there's only two way to get to this account : via SSH pubkey auth, or via local root then 'su'. It's obviously safer, although not safer than the user care for its private key (at least the weak part is where it is due, users, users....
    – zerodeux
    Jun 25, 2012 at 20:54
1

It would depend on if there was any other kind of interactive login they could use.

  1. Physical access
  2. su
  3. Auth via pam using /etc/passwd for any other service

I would have thought it was good practice to at least set a password - if you are not 100% confident that another application could authenticate via pam using /etc/passwd

1

You don't need to use a password on login, but I do suggest using a passphrase on the private key on the user. This means you'll have to use a forwarding agent, but then you provide security on the user's end if their machine is accessed or compromised.

Other than that potential issue, you should really be increasing security as there is no password for an attacker to even attempt to crack.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .