Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a username and an SSH key for a (hypothetical) guy and I need to give him admin access to a Linux (Ubuntu) server.

I want him to be able to log in via SSH and then set his password by himself over a secure connection, instead of passing the password around.

I know how to make the password expire and force him to reset it on first login. But this doesn't work unless he has some password already, which I then have to tell him.

I thought about making the password blank - SSH wouldn't allow login, but then anyone can su into the user.

My question is, is there some best practice to creating accounts in such a way? Or setting a default password is unavoidable?

share|improve this question

You have his SSH public key? Put it in .ssh/authorized_keys in his home directory. Once you have done that (and the permissions are restrictive enough - SSH is fussy about that.) he will be able to log in without needing a password at all... and he will never need one.

The best part is that his public key is not sensitive, so passing it around in emails or chat is fine, and his private key never leaves his computer.

share|improve this answer
He will need a password to sudo, won't he? – Leonid Shevtsov Sep 1 '12 at 23:51
You can allow passwordless sudo. – MDMarra Sep 1 '12 at 23:52
With a line like USERNAME = NOPASSWD: /usr/local/bin/ in /etc/sudoers and the script running the command /usr/bin/passwd USERNAME he won't need a password for (re-)setting his own password. – Ansgar Wiechers Sep 2 '12 at 1:22

Simply put a text file with the password inside that users home with rights 600. The user logs in with the key changes the password and deletes the file. With a skript with suid bit set you can even create something like passwd < textfile without giving the user the right to read the file (rights would be 060 with group= root )

share|improve this answer

Setting a default password is unavoidable. My procedure would be:

1) generate a secure, random password (different for each user). I use the password generator in OSX's account settings but you could use a website such as

2) Supply the password to them securely, e.g. in person or via

3) force a reset on first login as you already know how to do

share|improve this answer
Never, under no circumstances, use any kind of online password generator (or -checker for that matter). – Ansgar Wiechers Sep 2 '12 at 0:09
@AnsgarWiechers, can you support that statement with a good argument? – Zoredache Sep 2 '12 at 0:37
Too much involved that you're unable to control. Even if the code really is JavaScript running in the browser: do you peer-review the script every time before using it to make sure that it still doesn't send the password anywhere? – Ansgar Wiechers Sep 2 '12 at 1:07
Which is why you tell it to generate a few hundred passwords and choose one at random. – Grant Sep 2 '12 at 3:02
@Grant: Even if you pick one out of a few hundred passwords, an attacker would still be down to a few hundred guesses, which are far too easy to brute-force. There are enough options at hand to generate random passwords locally without any kind of web access involved. If you care about security at all: use one of those. – Ansgar Wiechers Sep 2 '12 at 11:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.