0

The manpage for usermod says this about locking a users account:

   -L, --lock
       Lock a user's password. This puts a ´!´ in front of the encrypted password, effectively disabling the password. You can´t use this option with -p or -U.

I have tried to use this to have a user only log in with the public key, but when I lock the account I get a password prompt. When I unlock the account again the public key works.

Edited: to make it clear: I want to be able to log in using the key still, and somehow locking the user gives me a password prompt when trying to use the key

2 Answers 2

3

As the man page says, this effectively locks the password - as in, it makes it impossible to use the existing password on this account.

It does not disable password-based login - you need to set the correct sshd(8) options for that.

I assume you mean "remotely login via ssh", since I don't know how a public key would be used locally.

1
  • Ok..the password thing makes sense, but I can't explain how that would block my key-based access, and you're right, it's a remote login. I don't want to block ssh password logins, I do however want to have this keybased login continue to work if I block the password login for the user using usermod, and the weird thing is I found a whole lot of pages explaining that this is how to do that..
    – datadevil
    Jan 18, 2012 at 15:06
0

Locking you password with usermod actually locks your whole account as you noticed. (System sees the ! added in front of the password as sign to not allow you log in.)

If you break you password hash by putting e.g. * in front of it you can still log in with public key.

Really you want to have a password for possible console logins etc. but disable password logins from ssh.

/etc/ssh/sshd_config:

  PasswordAuthentication no
1
  • Well I want to be able to have ssh passwords still, so I am probably going with your breaking the password hash trick. Does that break it to a degree that it's not brute force hackable either, or am I asking too much there..
    – datadevil
    Jan 20, 2012 at 12:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .