Mass creating users who can login via ssh keys but not with a password

Question

I am trying to mass creating users that can login via ssh private/public keys but which can not login with users (kind of like using newusers but I want to make sure users will not be able to login via ssh).

My approach: via script, I create users with useradd username, then I create the key via ssh-keygen and I put the public key as authorized_keys on the ssh server (assume that id_rsa, id_rsa.pub and authorized_keys are in the right places on both sides, permissions are correct and ownership as well)

Unfortunately, with useradd, accounts are created disabled. I can only login if I set the password with passwd first. if I try to enable the account with passwd -u username, it complains about it being unsafe (rightly so). I saw people recommending to lock the user with passwd -l but it still can not login even if the key is there. I could generate a random password but I am looking if there is a better way (no disallowing logins for all users is not an option)

Thanks in advance for your help.

Answer 1

I tried the following

# On machineA
useradd testuser
passwd -l testuser
# Created /home/testuser/.ssh                 drwx------ testuser testuser
# Created /home/testuser/.ssh/authorized_keys -rw------- testuser testuser

and

# On machineB
ssh -i /path/to/id_rsa -l testuser machineA

works. Also testuser doesn't have any valid password set yet and so login with password is impossible.