62

Is it possible with ssh to allow passwords from a certain user, but deny using passwords for everybody else?

Basically I want to allow password auth for user justin but everybody else must use public keys.

PasswordAuthentication no

Seems to be global though, no way to specify by user.

  • Look at the sshd_config man page, and look at the section for the Match directive. – cjc Sep 1 '11 at 22:42
  • 3
    Why? If you're the administrator of the server, your account ought to be protected just as much as the rest of the users, if not more so. – EEAA Sep 1 '11 at 22:49
  • 3
    This question how to disable SSH login with password for some users? has the answer you want. – Zoredache Sep 1 '11 at 22:50
  • When I try and use the match syntax, Match User justin PasswordAuthentication yes I am getting Bad configuration option: Match when I restart sshd. – Justin Sep 1 '11 at 22:57
  • 2
    Wow, how old is your SSH? – womble Sep 1 '11 at 23:01
74

Necromancing, but adding the following to your sshd_config should do the trick:

Match User <username>
    PasswordAuthentication yes

Note that match is effective "until either another Match line or the end of the file." (The indentation isn't significant.)

| improve this answer | |
  • 11
    You can also do a Match Group <groupname> if you want to use a common group to manage the password-allowed users (see this link). Remember to restart ssh, which you can do in Ubuntu with sudo service ssh restart. :) – ADTC Jan 2 '16 at 10:52
  • 6
    You want to end the Match block with "Match all" – AdamG May 3 '18 at 18:20
  • 2
    It didn't work for me... – Dimitrios May 23 '19 at 10:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.