Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've gotten keys (certificates) working correctly, but as it is, it's more of a "convenience" thing. (which I love). But as far as security, someone can still use a password to login. What's a good way to disable passwords and only allow certificate logins? I don't want to just choose a random password (which would probably work also), but I want to disable passwords entirely.

Ideas?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

Edit your sshd_config (likely /etc/ssh/sshd_config, but varies) and change this:

PasswordAuthentication yes

To this:

PasswordAuthentication no

To make it live you will need to restart your sshd daemon.

For more generally useful sshd configuration information you can run the following:

man sshd_config
share|improve this answer

What Neil said is correct, but you can also do usermod -L username to disable a user's password, but not his key login. This puts a "!" in front of the hash in /etc/shadow. Public key auth still works when you do that.

share|improve this answer
1  
There are other implications of this however - if your account is locked via usermod -L, then the user cannot sudo. Disabling password authentication via SSH is generally a better approach as well, as you don't need to remember to lock any new accounts you create. –  Daniel Lawson Jun 2 '11 at 21:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.