I have an Ubuntu Linux server allowing password authentication for SSH, and I want to switch it to SSH keys only and disable password login.

Before I disable password login, how can I find out which users are still using passwords, and which have switched to key authentication?

  • Btw., while many people don't know that, you can also ask for key and serverside password. A bit more bothersome, but of course more secure too, if you do that...
    – deviantfan
    Sep 28, 2017 at 20:49
  • 34
    Disable password login without notice and see how many people scream.
    – Mark
    Sep 28, 2017 at 23:44
  • 19
  • @deviantfan It would be more secure to simply require a longer keyfile, but that would require a bit of scripting.
    – jpaugh
    Sep 29, 2017 at 3:39
  • 1
    @deviantfan I take your point. But, you're assuming the password for the private key is different than the one for the server; (whereas, I'm assuming the private key file has a password, I know.)
    – jpaugh
    Sep 29, 2017 at 14:38

2 Answers 2


You can't do that 100% reliably, but there are two strong indications:

  • First, the presence of a .ssh/authorized_keys file is a hint the user is at least prepared to use key based login
  • Second, in the authentication log file (/var/log/secure on CentOS, /var/log/auth.log on Debian/Ubuntu), the auth method will be logged:

    Sep 28 13:44:28 hostname sshd[12084]: Accepted publickey for sven


    Sep 28 13:47:36 hostname sshd[12698]: Accepted password for sven

    Scan the log for entries with password mentioned to learn who is still using passwords. This will not work with users seldom logging in of course unless you have very long log retention.

  • by 'Scan' the log file, I presume you mean sensible options such as using grep? grep 'password' /var/log/ssh/sshd.log Sep 28, 2017 at 14:44
  • 8
    @djsmiley2k: Yes, exactly. Or whatever other method you prefer for that task.
    – Sven
    Sep 28, 2017 at 15:36
  • Isn't the first method thwarted by proper security practices, such as 700 permissions on the user's .ssh directory, and root squash on mounted home directories? Sep 29, 2017 at 20:21
  • 1
    @OgrePsalm33: You can do this search on the NFS server ...
    – Sven
    Sep 29, 2017 at 21:20
  • 1
    @R..: You can get NFS reasonably secure with NFSv4 and Kerberos (in which case key based login gets complicated ). Other than that: Yes, key based login works without any issues when ~/.ssh is set to 700 and in root squashed NFS home directories, so it clearly has to switch user ids at least for key based auth to read authorized_keys.
    – Sven
    Sep 30, 2017 at 16:50

Fastest way is to disable it and see who knocks on your office door ;p

  • 6
    This is not the fastest way, because not every user might login every day, while the logs can clearly show when someone logged in, so they give an instant result
    – Ferrybig
    Sep 29, 2017 at 7:47
  • 3
    This is the slowest way. People only login to the server if their application is down. It could take years for that to happen.
    – Navin
    Sep 29, 2017 at 21:10
  • @pete you are the top :)
    – c4f4t0r
    Oct 3, 2017 at 19:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .