Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The manpage for usermod says this about locking a users account:

   -L, --lock
       Lock a user's password. This puts a ´!´ in front of the encrypted password, effectively disabling the password. You can´t use this option with -p or -U.

I have tried to use this to have a user only log in with the public key, but when I lock the account I get a password prompt. When I unlock the account again the public key works.

Edited: to make it clear: I want to be able to log in using the key still, and somehow locking the user gives me a password prompt when trying to use the key

share|improve this question

2 Answers 2

As the man page says, this effectively locks the password - as in, it makes it impossible to use the existing password on this account.

It does not disable password-based login - you need to set the correct sshd(8) options for that.

I assume you mean "remotely login via ssh", since I don't know how a public key would be used locally.

share|improve this answer
    
Ok..the password thing makes sense, but I can't explain how that would block my key-based access, and you're right, it's a remote login. I don't want to block ssh password logins, I do however want to have this keybased login continue to work if I block the password login for the user using usermod, and the weird thing is I found a whole lot of pages explaining that this is how to do that.. –  datadevil Jan 18 '12 at 15:06

Locking you password with usermod actually locks your whole account as you noticed. (System sees the ! added in front of the password as sign to not allow you log in.)

If you break you password hash by putting e.g. * in front of it you can still log in with public key.

Really you want to have a password for possible console logins etc. but disable password logins from ssh.

/etc/ssh/sshd_config:

  PasswordAuthentication no
share|improve this answer
    
Well I want to be able to have ssh passwords still, so I am probably going with your breaking the password hash trick. Does that break it to a degree that it's not brute force hackable either, or am I asking too much there.. –  datadevil Jan 20 '12 at 12:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.