SSH Allow Password For One User, Rest Only Allow Public Keys [duplicate]

Question

Is it possible with ssh to allow passwords from a certain user, but deny using passwords for everybody else?

Basically I want to allow password auth for user justin but everybody else must use public keys.

PasswordAuthentication no

Seems to be global though, no way to specify by user.

Look at the sshd_config man page, and look at the section for the Match directive. — cjc, Sep 1, 2011 at 22:42
Why? If you're the administrator of the server, your account ought to be protected just as much as the rest of the users, if not more so. — EEAA, Sep 1, 2011 at 22:49
This question how to disable SSH login with password for some users? has the answer you want. — Zoredache, Sep 1, 2011 at 22:50
When I try and use the match syntax, Match User justin PasswordAuthentication yes I am getting Bad configuration option: Match when I restart sshd. — Justin, Sep 1, 2011 at 22:57

Charles L. · Accepted Answer · 2021-08-18 21:24:10Z

112

Necromancing, but adding the following to your sshd_config should do the trick:

Match User <username>
PasswordAuthentication yes
Match all

Note that match is effective "until either another Match line or the end of the file." (The indentation isn't significant.)

Charles L.

1235 bronze badges

answered May 28, 2015 at 14:35

T0xicCode

1,3111 gold badge10 silver badges11 bronze badges

14

You can also do a Match Group <groupname> if you want to use a common group to manage the password-allowed users (see this link). Remember to restart ssh, which you can do in Ubuntu with sudo service ssh restart. :)
– ADTC
Jan 2, 2016 at 10:52
10

You want to end the Match block with "Match all"
– AdamG
May 3, 2018 at 18:20
3

It didn't work for me...
– Dimitrios
May 23, 2019 at 10:27

Add a comment |

1 Answer 1