> ## Documentation Index
> Fetch the complete documentation index at: https://vastai-80aa3a82-docs-disable-ssh-password-login.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Disable SSH Password Login

> Turn off SSH password login to protect your machine.

Turn off SSH password login to protect your machine. A machine with it enabled
will not pass verification.

The steps are the same on Ubuntu Server 22.04 and 24.04.

<Warning>
  Do not turn off password login until you have confirmed your key works. Step 2
  is what stops you locking yourself out. Keep your current session open until the
  end.
</Warning>

## 1. Check the current setting

This asks sshd what it is actually using, with defaults and included files
resolved.

```bash theme={null}
sudo sshd -T | grep passwordauthentication
```

```
passwordauthentication yes
```

If it already says `no`, you are done. If it says `yes`, continue.

<Note>
  A fresh Ubuntu install says `yes`. Ubuntu ships the setting commented out, and
  sshd enables password login when the setting is absent.
</Note>

## 2. Add your key and confirm it works

From your own computer:

```bash theme={null}
ssh-copy-id youruser@1.2.3.4
```

```
Number of key(s) added: 1
```

Now open a second terminal, leaving the first one connected, and log in using
only your key. This proves the key is what is getting you in.

```bash theme={null}
ssh -o PreferredAuthentications=publickey youruser@1.2.3.4
```

You should get a shell prompt with no password asked.

<Warning>
  If you get `Permission denied (publickey)`, your key is not working. Stop here
  and fix it. Check that the key landed in `~/.ssh/authorized_keys` on the host,
  and that `~/.ssh` is mode `700` and `authorized_keys` is mode `600`.
</Warning>

## 3. Turn off password login

On the host:

```bash theme={null}
sudo nano /etc/ssh/sshd_config
```

Find the `PasswordAuthentication` line and set it to:

```
PasswordAuthentication no
```

<Warning>
  Removing the `#` is not enough. The value must be `no`. A line reading
  `PasswordAuthentication yes` still allows passwords.
</Warning>

## 4. Check for files that override it

Ubuntu reads extra config files from `/etc/ssh/sshd_config.d/`, and they win over
the main file. This is the most common reason the change looks done but the
machine still fails.

```bash theme={null}
sudo grep -r -i passwordauthentication /etc/ssh/sshd_config.d/ 2>/dev/null
```

No output means there is nothing to fix. Otherwise you will see something like:

```
/etc/ssh/sshd_config.d/50-cloud-init.conf:PasswordAuthentication yes
```

Edit that file and change `yes` to `no`, or delete the line.

<Note>
  `/etc/ssh/sshd_config` begins with `Include /etc/ssh/sshd_config.d/*.conf`, and
  OpenSSH keeps the first value it finds for a setting, so anything in that folder
  is read first. See the
  [Ubuntu Server OpenSSH guide](https://ubuntu.com/server/docs/how-to/security/openssh-server/).
</Note>

## 5. Test the config, then restart

`sshd -t` checks the file without touching the running service. Editing the file
alone changes nothing until you restart.

```bash theme={null}
sudo sshd -t && sudo systemctl restart ssh.service
```

No output means both worked. Existing sessions stay connected.

<Warning>
  Always run `sshd -t` before restarting. Restarting with a broken config can stop
  SSH from starting at all, leaving the console as your only way in.
</Warning>

<Note>
  Ubuntu 24.04 starts sshd on demand when a connection arrives, rather than running
  it constantly as 22.04 does. The command above is correct on both.
</Note>

## 6. Verify

Confirm the running service is now refusing passwords.

```bash theme={null}
sudo sshd -T | grep passwordauthentication
```

```
passwordauthentication no
```

If it still says `yes`, go back to step 4. Then log in once more from your own
computer to confirm, and close your original session.

<Note>
  Machines are rechecked about once an hour. If yours was already flagged, the
  error can take a couple of checks to clear after you fix it.
</Note>

## If you are locked out

You need access that does not go through SSH. Use the machine's IPMI, iDRAC, iLO,
or other BMC console, or plug a monitor and keyboard into it. Then set
`PasswordAuthentication yes` and run:

```bash theme={null}
sudo sshd -t && sudo systemctl restart ssh.service
```

Log in with your password, fix your key, and start again at step 2. Password
login has to go back off before the machine will verify.