Change or disable a UNIX user's password
Need to rotate a UNIX user's password, or turn off password login altogether so only SSH keys work?
This article walks you through both — they're the same dialog in Core.
What the password controls
A UNIX user's password authenticates SSH and SFTP logins. SSH keys are a separate, parallel method — adding a key doesn't disable the password, and changing the password doesn't affect existing keys.
FTP is unrelated. Each FTP user is its own object with its own password, set under the UNIX user's 'FTP' tab. Disabling password authentication on the UNIX user has no effect on FTP.
Where to change the password
The password lives on the UNIX user's 'SFTP & SSH' tab. There are two ways to get there.
Directly
- Navigate to 'Advanced' > 'UNIX Users'.
- Select the UNIX user.
- In the left sidebar, click 'SFTP & SSH'.
Via the project
- Navigate to 'Projects'.
- Select the project.
- Navigate to 'Advanced'.
- Under the 'UNIX User' tile, click 'Manage'.
- In the left sidebar, click 'SFTP & SSH'.
Change the password
On the 'SFTP & SSH' tab, find the 'Password Authentication' panel.
- Click 'Update password'.
- Leave 'Enable Password Authentication' on.
- In 'New Password', type the new password or click 'Generate' for a random 24-character one.
- Click 'Save'.
Copy it before saving
Once saved, the password is hashed and the dialog won't show it again. If you used 'Generate', copy the value before clicking 'Save'.
The minimum length is 24 characters.
Disable password authentication in full
To force key-only login (no password accepted at all):
- Click 'Update password' on the 'Password Authentication' panel.
- Turn the 'Enable Password Authentication' toggle off. The 'New Password' field disappears.
- Click 'Save'.
The panel will now show 'Disabled'. From that moment:
- SSH and SFTP refuse password attempts for this user.
- Existing SSH keys keep working — they're unaffected.
Re-enabling later means setting a new password through the same dialog. The previous password isn't recoverable.
Add a key first
Before disabling password authentication, make sure at least one working SSH key is attached to the user. Otherwise you'll lock yourself out — the only way back in is to re-enable the password from Core.