I've gotten keys (certificates) working correctly, but as it is, it's more of a "convenience" thing. (which I love). But as far as security, someone can still use a password to login. What's a good way to disable passwords and only allow certificate logins? I don't want to just choose a random password (which would probably work also), but I want to disable passwords entirely.



Edit your sshd_config (likely /etc/ssh/sshd_config, but varies) and change this:

PasswordAuthentication yes

To this:

PasswordAuthentication no

To make it live you will need to restart your sshd daemon.

For more generally useful sshd configuration information you can run the following:

man sshd_config

What Neil said is correct, but you can also do usermod -L username to disable a user's password, but not his key login. This puts a "!" in front of the hash in /etc/shadow. Public key auth still works when you do that.

  • 1
    There are other implications of this however - if your account is locked via usermod -L, then the user cannot sudo. Disabling password authentication via SSH is generally a better approach as well, as you don't need to remember to lock any new accounts you create. – Daniel Lawson Jun 2 '11 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.