Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am adding a new user account (to a CentOS 6.2 box) which will only use ssh key authentication (with a strong key passphrase of course). I have disabled ssh password auth in sshd_config.

Should I even use passwd to setup a password for them? Is there a security issue not creating a password?

share|improve this question

3 Answers 3

up vote 2 down vote accepted

No, you don't need a password if you will be only using SSH key authentication.

Even, if you set a password for this user, you can disable password authentication in sshd_config for specific users/groups.

share|improve this answer
2  
You should also make sure null passwords are disabled in PAM configuration if you use empty passwords and don't want users to be able to login with username only. –  Juraj Hrubša Jun 25 '12 at 12:08
    
I personnaly create my user accounts with 'adduser --disabled-password' (this is Debian specific), which makes sure there's only two way to get to this account : via SSH pubkey auth, or via local root then 'su'. It's obviously safer, although not safer than the user care for its private key (at least the weak part is where it is due, users, users.... –  zerodeux Jun 25 '12 at 20:54

It would depend on if there was any other kind of interactive login they could use.

  1. Physical access
  2. su
  3. Auth via pam using /etc/passwd for any other service

I would have thought it was good practice to at least set a password - if you are not 100% confident that another application could authenticate via pam using /etc/passwd

share|improve this answer

You don't need to use a password on login, but I do suggest using a passphrase on the private key on the user. This means you'll have to use a forwarding agent, but then you provide security on the user's end if their machine is accessed or compromised.

Other than that potential issue, you should really be increasing security as there is no password for an attacker to even attempt to crack.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.