Disable SSH Password Login

Turn off SSH password login to protect your machine.

Turn off SSH password login to protect your machine. A machine with it enabled will not pass verification.

The steps are the same on Ubuntu Server 22.04 and 24.04.

Do not turn off password login until you have confirmed your key works. Step 2 is what stops you locking yourself out. Keep your current session open until the end.

1. Check the current setting

This asks sshd what it is actually using, with defaults and included files resolved.

sudo sshd -T | grep passwordauthentication

passwordauthentication yes

If it already says no, you are done. If it says yes, continue.

A fresh Ubuntu install says yes. Ubuntu ships the setting commented out, and sshd enables password login when the setting is absent.

2. Add your key and confirm it works

From your own computer:

ssh-copy-id youruser@1.2.3.4

Number of key(s) added: 1

Now open a second terminal, leaving the first one connected, and log in using only your key. This proves the key is what is getting you in.

ssh -o PreferredAuthentications=publickey youruser@1.2.3.4

You should get a shell prompt with no password asked.

If you get Permission denied (publickey), your key is not working. Stop here and fix it. Check that the key landed in ~/.ssh/authorized_keys on the host, and that ~/.ssh is mode 700 and authorized_keys is mode 600.

3. Turn off password login

On the host:

sudo nano /etc/ssh/sshd_config

Find the PasswordAuthentication line and set it to:

PasswordAuthentication no

Removing the # is not enough. The value must be no. A line reading PasswordAuthentication yes still allows passwords.

4. Check for files that override it

Ubuntu reads extra config files from /etc/ssh/sshd_config.d/, and they win over the main file. This is the most common reason the change looks done but the machine still fails.

sudo grep -r -i passwordauthentication /etc/ssh/sshd_config.d/ 2>/dev/null

No output means there is nothing to fix. Otherwise you will see something like:

/etc/ssh/sshd_config.d/50-cloud-init.conf:PasswordAuthentication yes

Edit that file and change yes to no, or delete the line.

/etc/ssh/sshd_config begins with Include /etc/ssh/sshd_config.d/*.conf, and OpenSSH keeps the first value it finds for a setting, so anything in that folder is read first. See the Ubuntu Server OpenSSH guide.

5. Test the config, then restart

sshd -t checks the file without touching the running service. Editing the file alone changes nothing until you restart.

sudo sshd -t && sudo systemctl restart ssh.service

No output means both worked. Existing sessions stay connected.

Always run sshd -t before restarting. Restarting with a broken config can stop SSH from starting at all, leaving the console as your only way in.

Ubuntu 24.04 starts sshd on demand when a connection arrives, rather than running it constantly as 22.04 does. The command above is correct on both.

6. Verify

Confirm the running service is now refusing passwords.

sudo sshd -T | grep passwordauthentication

passwordauthentication no

If it still says yes, go back to step 4. Then log in once more from your own computer to confirm, and close your original session.

Machines are rechecked about once an hour. If yours was already flagged, the error can take a couple of checks to clear after you fix it.

If you are locked out

You need access that does not go through SSH. Use the machine’s IPMI, iDRAC, iLO, or other BMC console, or plug a monitor and keyboard into it. Then set PasswordAuthentication yes and run:

sudo sshd -t && sudo systemctl restart ssh.service

Log in with your password, fix your key, and start again at step 2. Password login has to go back off before the machine will verify.