69

Is it possible with ssh to allow passwords from a certain user, but deny using passwords for everybody else?

Basically I want to allow password auth for user justin but everybody else must use public keys.

PasswordAuthentication no

Seems to be global though, no way to specify by user.

8
  • Look at the sshd_config man page, and look at the section for the Match directive.
    – cjc
    Sep 1 '11 at 22:42
  • 3
    Why? If you're the administrator of the server, your account ought to be protected just as much as the rest of the users, if not more so.
    – EEAA
    Sep 1 '11 at 22:49
  • 3
    This question how to disable SSH login with password for some users? has the answer you want.
    – Zoredache
    Sep 1 '11 at 22:50
  • When I try and use the match syntax, Match User justin PasswordAuthentication yes I am getting Bad configuration option: Match when I restart sshd.
    – Justin
    Sep 1 '11 at 22:57
  • 2
    Wow, how old is your SSH?
    – womble
    Sep 1 '11 at 23:01
89

Necromancing, but adding the following to your sshd_config should do the trick:

Match User <username>
PasswordAuthentication yes
Match all

Note that match is effective "until either another Match line or the end of the file." (The indentation isn't significant.)

3
  • 12
    You can also do a Match Group <groupname> if you want to use a common group to manage the password-allowed users (see this link). Remember to restart ssh, which you can do in Ubuntu with sudo service ssh restart. :)
    – ADTC
    Jan 2 '16 at 10:52
  • 7
    You want to end the Match block with "Match all"
    – AdamG
    May 3 '18 at 18:20
  • 2
    It didn't work for me...
    – Dimitrios
    May 23 '19 at 10:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.