I have a username and an SSH key for a (hypothetical) guy and I need to give him admin access to a Linux (Ubuntu) server.
I want him to be able to log in via SSH and then set his password by himself over a secure connection, instead of passing the password around.
I know how to make the password expire and force him to reset it on first login. But this doesn't work unless he has some password already, which I then have to tell him.
I thought about making the password blank - SSH wouldn't allow login, but then anyone can
su into the user.
My question is, is there some best practice to creating accounts in such a way? Or setting a default password is unavoidable?