I have debian running on virtualbox. There is only 2 users: root and user.

I want to completely turn off password based authentication in console and via ssh for both root and user.

I want user to be able to login with private key and be able to either elevate to root or to run sudo.

To turn off ssh I do

PasswordAuthentication no
PermitRootLogin no

But that still leaves console-based login working. And inserting invalid hash in /etc/shadow, or setting /usr/sbin/nologin in /etc/passwd for both users disables sudo and su.

  • Try disabling getty (the program that ask for the login on the console), for example via systemd. – dirkt Sep 9 at 6:56

To disable automatic spawning of virtual terminals, set the following in /etc/systemd/logind.conf:


getty@tty1.service probably starts by default, so disable it:

systemctl disable getty@tty1.service

I think you need to restart systemd-logind.service:

systemctl restart systemd-logind.service

and manually stop any existing getty@ttyN.service:

systemctl stop "getty@tty*.service"

This may not terminate all processes using ttys, so you may want to examine the output of ps to find processes having /dev/tty* as their controlling terminals and deal with them. The -t option of ps may be helpful.

Or just reboot.

The relevant fragment of man 5 logind.conf:

Takes a positive integer. Configures how many virtual terminals (VTs) to allocate by default that, when switched to and are previously unused, "autovt" services are automatically spawned on. These services are instantiated from the template unit autovt@.service for the respective VT TTY name, for example, autovt@tty4.service. By default, autovt@.service is linked to getty@.service. In other words, login prompts are started dynamically as the user switches to unused virtual terminals. Hence, this parameter controls how many login "gettys" are available on the VTs. If a VT is already used by some other subsystem (for example, a graphical login), this kind of activation will not be attempted. Note that the VT configured in ReserveVT= is always subject to this kind of activation, even if it is not one of the VTs configured with the NAutoVTs= directive. Defaults to 6. When set to 0, automatic spawning of "autovt" services is disabled.

Takes a positive integer. Identifies one virtual terminal that shall unconditionally be reserved for autovt@.service activation (see above). The VT selected with this option will be marked busy unconditionally, so that no other subsystem will allocate it. This functionality is useful to ensure that, regardless of how many VTs are allocated by other subsystems, one login "getty" is always available. Defaults to 6 (in other words, there will always be a "getty" available on Alt-F6.). When set to 0, VT reservation is disabled.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.