Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am adding a new user account (to a CentOS 6.2 box) which will only use ssh key authentication (with a strong key passphrase of course). I have disabled ssh password auth in sshd_config.

Should I even use passwd to setup a password for them? Is there a security issue not creating a password?

share|improve this question
up vote 2 down vote accepted

No, you don't need a password if you will be only using SSH key authentication.

Even, if you set a password for this user, you can disable password authentication in sshd_config for specific users/groups.

share|improve this answer
2  
You should also make sure null passwords are disabled in PAM configuration if you use empty passwords and don't want users to be able to login with username only. – Fedor Piecka Jun 25 '12 at 12:08
    
I personnaly create my user accounts with 'adduser --disabled-password' (this is Debian specific), which makes sure there's only two way to get to this account : via SSH pubkey auth, or via local root then 'su'. It's obviously safer, although not safer than the user care for its private key (at least the weak part is where it is due, users, users.... – zerodeux Jun 25 '12 at 20:54

It would depend on if there was any other kind of interactive login they could use.

  1. Physical access
  2. su
  3. Auth via pam using /etc/passwd for any other service

I would have thought it was good practice to at least set a password - if you are not 100% confident that another application could authenticate via pam using /etc/passwd

share|improve this answer

You don't need to use a password on login, but I do suggest using a passphrase on the private key on the user. This means you'll have to use a forwarding agent, but then you provide security on the user's end if their machine is accessed or compromised.

Other than that potential issue, you should really be increasing security as there is no password for an attacker to even attempt to crack.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.