Unfortunately, not all (client) software that supports SSH/SFTP supports publickey authentication.

How would one set up a standard Ubuntu desktop (with sshd enabled) so that you could use an easy password to login locally, but need a different (more secure) password to login to the same account via SSH?

I would prefer to remain able to login to the desktop user via publickey auth, for those programs that do support it.

  • only way I'm aware of requires a FreeIPA domain and hbac – Jacob Evans Apr 11 '17 at 12:01
  • 2
    Use an SSH key and encrypt the key with the "easy" password. – TheFiddlerWins Apr 11 '17 at 19:58
  • @TheFiddlerWins That doesn't work, because the apps I'm talking about simply do not support publickey auth. They literally have 'host', 'port', 'username', 'password'. I'd like to use a secure password there, and an easy password for local logins to the same user. – SomeoneSomewhereSupportsMonica Apr 12 '17 at 10:41

Have another user for SSH Login and use sudo

or su - if need to Access the Desktop-User Profile.

Disable the Desktop-User in /etc/ssh/sshd_conf with "DenyUsers":



DenyUsers Desktop-User


  • This would prevent logging in to the desktop user with publickey auth, correct? I'd rather avoid that if possible. – SomeoneSomewhereSupportsMonica Apr 11 '17 at 11:56

I don't know if I understand your request but if I understand right, you need a user who can log in to the server locally and via SSH but with different passwords?

If that is the case, simply create an SSH keypair with a different password and allow remote login with SSH keypair. In /etc/ssh/sshd_config find the line: PasswordAuthentication. Set this to no. From this point the users will be able to log in to your server via SSH if they have a private key available on their client, and they will have to enter the SSH keys passphrase instead the users password that you use to log in locally.

  • As I've said, lots of clients simply do not support logins using keypairs, and using a different third party app to connect isn't so feasible on mobile. – SomeoneSomewhereSupportsMonica Apr 12 '17 at 10:42

OpenSSH and other ssh servers I'm aware of don't allow changing these things only for ssh logins, but there are ways to hack your way around it.

OpenSSH can use PAM for authentication. Unfortunately it doesn't allow specifying a non-default PAM service, so you'll need to change the main PAM configuration. Pam isn't very flexible, but there are modules that allow PAM to run a custom script on login, so you could try to create a pam script that detects SSH logins and then accepts a different password from a non-SSH login. I don't know PAM in detail, so this is just a general description

Another (probably easier) way to hack the system could be to run the SSH server in a separate mount namespace, and bind-mount a different /etc/shadow with different passwords, then SSHd would use these while local logins would not. (Note that if a user logs in over SSH and then is able to run login or in some other way attempt a local login that will also be checked against the SSH password database.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.