4

I'm following these steps when setting up the user:

$ sudo useradd periscope -m -s /bin/false
$ sudo su -s /bin/bash periscope
$ mkdir ~/.ssh
$ # public key gets manually input here
$ cat - >> ~/.ssh/authorized_keys
$ chmod 600 ~/.ssh/authorized_keys
$ chmod go-w ~/ ~/.ssh

Now when I try to log into this user I'm faced with the following error in /var/log/auth.log:

Jun 13 18:50:21 ip-172-31-27-167 sshd[12811]: User periscope not allowed because account is locked
Jun 13 18:50:21 ip-172-31-27-167 sshd[12811]: input_userauth_request: invalid user periscope [preauth]

and /etc/shadow shows:

periscope:!:17331:0:99999:7:::

which according to https://en.wikipedia.org/wiki/Passwd means that the user is locked from a password login (good) but could be authorized to log in with SSH, which is what I want. auth.log doesn't agree however.

The way I've fixed this before is by setting a random password for that user, ssh would work then. Doesn't feel like the right solution though, I'm not enabling (or maybe not, since it's disabled in sshd?) a login method I am not interested in.

Another option that folks suggested was to use sudo passwd -u periscope instead but then I get the following error:

passwd: unlocking the password would result in a passwordless account.
You should set a password with usermod -p to unlock the password of this account.

Is setting a password for a user, even though I never intend on using it, unavoidable?

9
  • Have you checked your SSH settings for your server? Also, It looks like you might be shooting yourself in the foot by setting the /bin/false as the shell... unless you are going to manually call the shell when sshing in. – ben-Nabiy Derush Jun 15 '17 at 20:35
  • @ben-NabiyDerush - what specific settings do you recommend I take a look into? – Alexandr Kurilin Jun 15 '17 at 21:14
  • @ben-NabiyDerush regarding /bin/false this user will only be used for ssh forwarding as per periscopedata.com/blog/redshift-cluster-setup-private-ip.html – Alexandr Kurilin Jun 15 '17 at 21:14
  • 1
    Ok. Well, I followed the same steps you used for creating the account etc, but mine worked (apart from /bin/false not allowing session to remain) I would look into /etc/ssh/sshd_config and make sure UsePAM is yes and PubKeyAuthentication is yes. That would be a start – ben-Nabiy Derush Jun 15 '17 at 21:22
  • IIRC ~/.ssh must be mode 700 (i.e. go-rwx) - I think go-w is still too permissive – steeldriver Jun 15 '17 at 22:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.