Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've gotten keys (certificates) working correctly, but as it is, it's more of a "convenience" thing. (which I love). But as far as security, someone can still use a password to login. What's a good way to disable passwords and only allow certificate logins? I don't want to just choose a random password (which would probably work also), but I want to disable passwords entirely.


share|improve this question
up vote 5 down vote accepted

Edit your sshd_config (likely /etc/ssh/sshd_config, but varies) and change this:

PasswordAuthentication yes

To this:

PasswordAuthentication no

To make it live you will need to restart your sshd daemon.

For more generally useful sshd configuration information you can run the following:

man sshd_config
share|improve this answer

What Neil said is correct, but you can also do usermod -L username to disable a user's password, but not his key login. This puts a "!" in front of the hash in /etc/shadow. Public key auth still works when you do that.

share|improve this answer
There are other implications of this however - if your account is locked via usermod -L, then the user cannot sudo. Disabling password authentication via SSH is generally a better approach as well, as you don't need to remember to lock any new accounts you create. – Daniel Lawson Jun 2 '11 at 21:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.