Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a dedicated system account named "git" that is managed by gitlab/gitolite. Users connecting to this account always use SSH keys, "git" user doesn't have a password. If users connect without a SSH key or with a mis-configured key, they get confused by being asked for a password. I'm looking for a way how to set up the server so that in such a case it doesn't ask for a password and instead it displays some kind of user-friendly message ("Your key is missing or invalid" etc.) and drops the connection. Is it possible, either in sshd configuration, or in some other way (PAM perhaps)?

Note that I'm not asking how to set up public/private password-less connections. Just how to prevent the server asking for a password for a single specific user.

(I understand that such setup reveals to a potential attacker that user "git" exists in the system. But since "git" has no password and an attacker can easily determine its existence anyway, I consider it only a low risk.)

share|improve this question
up vote 3 down vote accepted

You can disable password logins for that specific user. You can't provide a specific message, but at least they won't be prompted for a password. Add the following in /etc/ssh/sshd_config:

Match user git
    PasswordAuthentication no
    ChallengeResponseAuthentication no
share|improve this answer
I had to remove UsePAM no because the server complained it's not allowed inside Match, but otherwise it does exactly what I wanted. Thanks. – Petr Pudlák Feb 19 '13 at 17:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.