I'm trying to create a user on a Linux box that can only log on via ssh with a key specified in authorized_keys. The user should not be able to log on via password, neither via ssh nor locally at the console. How would I do this?

Currently I do:

useradd -m myuser
passwd myuser
vi /etc/shadow

and replace the password field with '*'. There must be a better way? If I don't set the passwd first, ssh won't work either saying in the log "User myuser not allowed because account is locked"


passwd -l myuser will effectively disable user password

  • Didn't know about that flag. Thank you. – Johannes Ernst Jan 25 '15 at 21:04

Give them a password and don't tell them what it is.

  • Never mind the user; the machine is on the public internet, and I simply don't want the possibility of anybody logging on without ssh keys which are stronger than any password. – Johannes Ernst Jan 25 '15 at 4:57
  • @JohannesErnst If you use head -c57 /dev/urandom | base64 to generate the password, then nobody is going to guess that password. – kasperd Jan 25 '15 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.