I have seen two recommendations for disabling password authentication after having transferred your public SSH key to an Ubuntu server. Each involves a different modification of the sshd_config file.

  1. This Digital Ocean article recommends PermitRootLogin without-password

  2. This tutorial recommends PasswordAuthentication no

What is the difference between the two?


PermitRootLogin without-password is a bit of a misnomer (which is why in recent versions of OpenSSH it is deprecated in favour of PermitRootLogin prohibit-password). What it does is allow root to login, but only through methods other than password authentication; for example key-based authentication is allowed. It has no effect on users other than root.

PasswordAuthentication no prohibits password authentication for all users. Note that, by using a Match block, it is possible to prohibit password authentication for only some users, or to allow it for some users when it is globally prohibited:

# Prohibit password authentication only for user foo
Match User foo
    PasswordAuthentication no

# Prohibit password authentication for all users other than foo
PasswordAuthentication no
Match User foo
    PasswordAuthentication yes

Match blocks can also match other things, for example by using hostname matching you can allow password authentication from machines on the local network only. See man sshd_config for details.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.