My question is the next, Could I create users in server (on sshd), when ssh client connect to the server and in this moment create account in server with a spectific group and permissions for this login request?

So, If user doesnt exist in SERVER, SSHD or PAM must create and allow log with credentials from the user that wants connect? Like one step and automatic login.

Thanks in advance.


1 Answer 1


While it's theoretically possible, it's not easy and it's a really bad idea.

The reason it's a bad idea is that you would effectively give the entire internet access to your server if only they figure out a username that does not already exist.

Still, here are three ways to make it work.

The easiest way is to have a script that is watching /var/log/auth.log and looking for failed logins, and when someone is trying to login to a non-existent user it'd create that user. This will require the user to try a second time in order to actually get access.

A second way would be to use a pam module to allow random users to login even when they don't exist. Or you could use kerberos, and setup a kerberos server that will answer positively to any login request regardless of the username.

A third way would be to rewrite the sshd source to create the user when someone tries to connect.

And I strongly advise you against using any of these ideas on any server connected to the internet.

  • 2
    Listen to Jenny, this is a VERY BAD idea!!! Unless your goal is to show how quickly you can hand over your machine to someone on the net.
    – Jason H
    Jun 3, 2013 at 12:09
  • Thanks, but I need log user from my application and it will do that the user will be created on the fly.
    – ManuParra
    Jun 3, 2013 at 16:41
  • So it's your application that's using ssh, not the user directly? If that's the case, then it's a lot simpler.
    – Jenny D
    Jun 4, 2013 at 5:16
  • 1
    I've thought a bit more. It seems to me that this is an XY problem (meta.stackexchange.com/questions/66377/what-is-the-xy-problem). If what you really want is for your application to create users on the fly, then there are other ways to do this without opening up a giant big security hole large enough to fly the Enterprise through. Maybe you could post about the actual problem instead?
    – Jenny D
    Jun 4, 2013 at 7:08
  • Yes I understand!
    – ManuParra
    Jun 4, 2013 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.