Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is it possible to disable PASSWORD SSH access to user but to allow Key authentication on a per user basis ? I mean, I have a userA whom I don't want to give Password based access BUT I wan't him to only use key authentication to access the server(s). Thanks

share|improve this question

3 Answers 3

up vote 15 down vote accepted

you can add "Match" sections to match on particular users or groups at the bottom of sshd_config, like:

Match user stew
PasswordAuthentication no

or

Match group dumbusers
PasswordAuthentication no
share|improve this answer
2  
I would avoid indenting as it suggests that only the indented lines are affected by Match when in reality, all configuration is affected until the next Match directive. Could be confusing to someone not familiar with with the syntax. –  Michael Mior Dec 29 '13 at 7:25

Just lock the passwords of the users you don't want to log in with passwords:

usermod -L <user>

Then, place a valid public key in their .ssh/authorized_keys file and they will be only able to log in with the corresponding private key, but not with a password.

share|improve this answer
3  
That also will break sudo. Perhaps not an issue in this case, but it bears mention. –  EEAA May 8 '12 at 15:25
    
Yes, that is true. I should have mentioned it. –  Oliver May 8 '12 at 15:26
    
Some OpenSSH setups (e.g. i think Ubuntu 14.04 in default config) do not let locked users in, not even via authorized_keys –  Nils Toedtmann Sep 18 at 12:38

you should look into

/etc/ssh/sshd_config

I think what you're looking for is

PasswordAuthentication yes

change it to no and don't forget to restart sshd

share|improve this answer
    
I'm aware of this - this is a GLOBAL settings though - I want more granular option - that's why I said "per-user basis" - I want this only for some users (used for innercluster communication between the servers in the cluster) - not for all users –  gyre May 8 '12 at 15:22
    
oh right, i'm sorry i didn't read it correctly then what @stew recommended is a way to go –  alexus May 8 '12 at 15:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.