0

I'm playing around with a script to create a user across a number of machines. I'd like to not know the users password at any time, but having the public SSH keys is quite acceptable to me. The user will need to use sudo so a password is needed for privilege escalation. Can the user set the password for themselves without having a password to log in? So far, all my testing of this password creation scheme has failed to find a way for the user to change their password.

Here is the script so far.

# Must be run with root permissions 
# sudo will be sufficient

if [ "$(id -u)" != "0" ]; then
   echo "This script must be run as root" 1>&2
   exit 1
fi

# Create User
user=newadmin
adduser $user --disabled-password --gecos "New Admin"
adduser $user sudo
adduser $user adm

# Create and populate authorized keys
keys=/home/$user/.ssh/authorized_keys
mkdir /home/$user/.ssh
chmod 700 /home/$user/.ssh
touch $keys
chmod 600 $keys

cat <<EOT >> $keys
${relevant_content_for-authorized_keys-file_here}
EOT

chown -R $user:$user /home/$user/.ssh

# Check that the file exists and that ownership is correct
# TODO: check permissions of file and directory also
if [ `stat -c '%U' $keys`==$user ]
then
  echo "Successfully created $keys for $user"
else
  echo "Failed to configure $keys properly for $user"
fi

If I must, I'll fall back on a short password expiration, but I'd rather them not be able to elevate privileges until their password is set to something I don't know.

echo "password:$user" | chpasswd
chage -M 4 $user

Yes, I know I'm a paranoid sysadmin. :-)

  • I would think it would be possible, since SSH doesn't (completely) rely on the user's password, but you might have to set some random password initially rather than having a disabled password. – saiarcot895 May 12 '15 at 15:57
3

Your question is not making much sense as the user in question has sudo access.

So ...

  1. Yes a use can change the password on the ssh keys.

and

  1. A user with root access can change the password of any other user on the system or lock an account without knowing the password of the target account.

I am not sure how you are giving them root access or if root access is limited in any way. If you are using the default sudo configuration, then they know their password so can change it. If you are using su , once they have root access they can do what they wish unless you restrict them with a tool such as apparmor or selinux

Perhaps you can lock the account and force the new user to set a password at first login.

From https://unix.stackexchange.com/questions/50699/force-pubkey-auth-user-to-set-password-at-first-login

Add this to your script:

passwd -d $user

chage -d0 $user

  • 1
    sudo access requires the entry of a password that the user doesn't know so they don't have sudo access, just the potential for it if they know their password. – flickerfly May 12 '15 at 16:10
  • Well, this is why your question does not make sense. Short of root access, a user without root access can not change his or her password without knowing his or her current password. Sudo can be configured to accept the target (root) password, no password, and / or give limited access to commands. It would help if you gave (sudo) details in your question. Without giving a password, adding access to root (sudo) does not make much sense. – Panther May 12 '15 at 16:44
  • See also - unix.stackexchange.com/questions/50699/… - The account can be locked, and you can force the user to set a password when he or she first logs in via ssh. – Panther May 12 '15 at 16:48
  • Ah, so using the command 'chage -d0 $user' will force the user to change the password and only ever user the temporary password for a password change. That'll do what I want. If you edit your answer to that info, I'll gladly accept it. – flickerfly May 12 '15 at 17:14
  • I found I don't need the passwd -d $user since I'm using the --disabled-password option on adduser. Thank for helping me think through this. I got lost in the weeds. – flickerfly May 12 '15 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.