Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On Linux (Debian Squeeze) I would like to disable SSH login using password to some users (selected group or all users except root). But I do not want to disable login using certificate for them.

edit: thanks a lot for detailed answer! For some reason this does not work on my server:

Match User !root
PasswordAuthentication no

...but can be easily replaced by

PasswordAuthentication no
Match User root
PasswordAuthentication yes
share|improve this question
    
Maybe it's because of your indentation? –  nil Jan 30 '13 at 7:19
    
It's worth mentioning that those lines under match should be at the end of the file –  zidarsk8 Dec 25 '13 at 1:29

3 Answers 3

up vote 62 down vote accepted

Try Match in sshd_config:

Match User user1,user2,user3,user4
    PasswordAuthentication no

Or by group:

Match Group users
    PasswordAuthentication no

Or, as mentioned in the comment, by negation:

Match User !root
    PasswordAuthentication no
share|improve this answer
2  
prefer Match user !root for this case –  84104 Jun 30 '11 at 16:41
1  
Awesome, I didn't know about the Match syntax. One suggestion I would make, though, is if this is a public facing server, I wouldn't allow root login through SSH at all. Probably not a huge deal if it's Internal though.. –  Safado Jun 30 '11 at 17:47
3  
@SpacemanSpiff That's what a) strong passwords and b) denyhosts/fail2ban are for. –  ceejayoz Jul 4 '11 at 19:56
1  
@deed02392 You can consider a key to be a really, really strong password if you like. –  ceejayoz Jul 5 '13 at 13:26
2  
It's so much stronger it's not in the same ball-park, that was my point. Password authentication should be disabled for root too and keys only allowed for logins. –  deed02392 Jul 6 '13 at 11:49

Also note:

Put these lines to the end (!) of the file /etc/ssh/sshd_config and reload the SSH config:

sudo /etc/init.d/ssh reload

share|improve this answer
3  
Quite important in order to avoid errors such as: Directive XYZ is not allowed within a Match block. –  pl1nk Oct 26 '12 at 15:41

There are a few ways that you can do this - first, you could concievably run a second sshd daemon on a different port with different config - its a bit of a hack, but with some chroot work it should work just fine.

Also, you could allow password authentication, but lock the passwords for all but the one user. The users with locked passwords will still be able to authenticate with public keys.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.