How to lock a user so they can only login with an ssh key?

[sdwilsh]

I'm trying to add a user that I can log into only with ssh. I had assumed that adding lock_passwd: true to the user in the config.yml I pass during a manual install would do the trick, but that seems to completely lock the user; I cannot log in at all via password or ssh. If I don't supply anything to passwd, I can login at the terminal without any password.

I noticed that @Ognian also asked this in a different discussion but didn't see an answer there.

[Ognian]

Actually I forgot about this ... I found out that this has to do with the sshd config (/etc/ssh/sshd_config) i.e.this. So actually it has to be changed i.e with sed ... but I haven't implemented this yet.

[mudler]

Hey @sdwilsh 👋

Thanks for bringing this up - this is indeed a miss in our docs, and we can definitely smooth the UX here by providing a config option for it.

Could you please fill in a ticket so we can track it in our sprints? Thanks 🙏!

[sdwilsh]

I filed #789, which is a bit broader in scope, but would accomplish this (and I was going to file it anyway).