Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.
  1. I have configured sshd on an Ubuntu server to use key authentication and it is working fine.
  2. I had to disable password authentication for key authentication to work.
  3. Server is always accessed via remote terminals or putty.

Now all user accounts are able to login with the authentication key and passphrase. But now I want to create only one new user without key authentication. So how should I go about doing this in such a way that does not hamper other users who are using key authentication.

share|improve this question
    
It is not correct that you must disable password authentication for key authentication to work. However, disabling password authentication is usually a good thing anyway (unless you have a lot of trust in your users to choose excellent passwords -- and possibly even then). In any case, you have received good answers about how to disable password authentication for all but a single user, and that is probably the right strategy to follow. –  D.W. Aug 21 '12 at 6:51
add comment

2 Answers

You can use match in sshd_config to select individual users to alter the PasswordAuthentication directive for.

Match User root,foo,bar
    PasswordAuthentication no
Match User Rishee
    PasswordAuthentication yes

This would give root, foo and bar key authentication, and Rishee password authentication.

An alternative is to match by negation, like this:

PasswordAuthentication no
Match User !root
    PasswordAuthentication yes

In this case, everyone except root gets password authentication.

You can also match by group:

Match Group usergroup
    PasswordAuthentication no
share|improve this answer
2  
I didn't even know that was possible, cool :D –  Lucas Kauffman Aug 2 '12 at 11:19
    
@Polynomial I created a user called auditor with a password and then I updated the /etc/ssh/sshd_config with the below entry. : <br />Match User auditor PasswordAuthentication yes <br /> then tried to connect to the server with putty it said server refused connection No authentication method supported. –  Rishee Aug 2 '12 at 12:07
    
I'd need to see the full set of authentication rules to help really. Could you stick it on a pastebin for me? Though, at this point, your question might be better suited to Ask Ubuntu. –  Polynomial Aug 2 '12 at 12:12
    
@Polynomial Pastbin for sshd_config I have also asked it on askubuntu + Superuser + ServerFault –  Rishee Aug 2 '12 at 13:06
    
Try inverting the way you've written it -> pastebin.com/h5bgWFrr –  Polynomial Aug 2 '12 at 13:16
show 2 more comments

You can enable password and key-authentication at the same time, they are not exclusive.

share|improve this answer
    
But they're not selective. (EG. Not multifactuor) It allows multiple single factors. Though redhat fixed that –  Ori Aug 3 '12 at 3:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.