47

This question already has an answer here:

Is it possible with ssh to allow passwords from a certain user, but deny using passwords for everybody else?

Basically I want to allow password auth for user justin but everybody else must use public keys.

PasswordAuthentication no

Seems to be global though, no way to specify by user.

marked as duplicate by Andrew Schulman, kasperd, MadHatter, mdpc, masegaloeh Jun 2 '15 at 13:21

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Look at the sshd_config man page, and look at the section for the Match directive. – cjc Sep 1 '11 at 22:42
  • 3
    Why? If you're the administrator of the server, your account ought to be protected just as much as the rest of the users, if not more so. – EEAA Sep 1 '11 at 22:49
  • 3
    This question how to disable SSH login with password for some users? has the answer you want. – Zoredache Sep 1 '11 at 22:50
  • When I try and use the match syntax, Match User justin PasswordAuthentication yes I am getting Bad configuration option: Match when I restart sshd. – Justin Sep 1 '11 at 22:57
  • 2
    Wow, how old is your SSH? – womble Sep 1 '11 at 23:01
55

Necromancing, but adding the following to your sshd_config should do the trick:

Match User <username>
    PasswordAuthentication yes

Note that match is effective "until either another Match line or the end of the file." (The indentation isn't significant.)

  • 7
    You can also do a Match Group <groupname> if you want to use a common group to manage the password-allowed users (see this link). Remember to restart ssh, which you can do in Ubuntu with sudo service ssh restart. :) – ADTC Jan 2 '16 at 10:52
  • 3
    You want to end the Match block with "Match all" – AdamG May 3 '18 at 18:20
  • It didn't work for me... – Dimitrios May 23 at 10:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.