[Freeipa-users] user account without password

[Martin Kosek]

On 04/10/2015 06:36 AM, Alexander Frolushkin wrote:
> Hello!
> Is there any direct or indirect way to create a IPA user accounts without usable password?
> So, no one can ever authenticate this accounts using the account password (so it will be the only way to use account via "sudo su - username" from another account)?

You can simply create a user without Kerberos password assigned (do not use
--password option or "ipa passwd" command) and use "--shell /sbin/nologin" as
other system accounts that are usually found on the system.