I tried following the instructions here: http://lani78.wordpress.com/2008/08/08/generate-a-ssh-key-and-disable-password-authentication-on-ubuntu-server/

to only allow users with a public key on the server to authenticate, but I can't get SSH to disallow logging in with only a username/password.

Here is my sshd_config file - am I missing anything? I already tried restarting SSH and the computer itself.

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile        %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM no
  • 2
    FYI : Actually the sshd restart is not really necessary. The command /etc/inid.d/ssh reload should be enough.
    – Oliv
    Feb 24, 2016 at 22:23
  • Don't forget to uncomment #AuthorizedKeysFile and to copy the public key to ~/.ssh/authorized_keys (and restart). Without this, it won't work.
    – ivanleoncz
    Jan 25, 2019 at 21:04
  • 1
    If it wasn't true in 2016, it is definitely the case in 2019 that a restart is required; reload is not sufficient.
    – KDN
    May 18, 2019 at 21:50

5 Answers 5


By default PasswordAuthentication is set to yes, so explicitly commenting it in /etc/ssh/sshd_config and restart sshd has no effect.

You'll need to explicitly set PasswordAuthentication no to allow only Public Key Authentication.

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no

PubkeyAuthentication yes

NOTE (man sshd_config): PasswordAuthentication specifies whether password authentication is allowed. The default is yes.

And restart sshd

  • for sysvinit service ssh restart
  • for systemd systemctl restart sshd.service.

Additionally, it is best practice to use the following directives (in order) DenyUsers AllowUsers DenyGroups AllowGroups for finer SSH access control granularity and flexibility. -> Reference: man 5 sshd_config ---> Ubuntu openssh man page does not include this any more as it absorbs openssh upstream docs (but FreeBSD, EL 7, 8 man page still have them).

Last but not least

NOTE: be careful with setting UsePAM no as that way password locked user accounts (this is different from disabled / expired user accounts -> man passwd and man usermod) will NOT be able to login even if they have public key authentication configured in ~/.ssh/authorized_keys.

  • 8
    Also we should have UsePAM no Apr 7, 2015 at 21:22
  • @pidosaurus why? what is it good for?
    – jan-glx
    Dec 11, 2015 at 11:56
  • 1
    @YAK I like to keep things simple and I prefer not to use PAM. But somebody can use a properly configured PAM authentication. I think this link is enlightening: arlimus.github.io/articles/usepam Dec 15, 2015 at 14:00
  • 1
    Consider also disabling ChallengeResponseAuthentication, see superuser.com/a/374234/2879.
    – cic
    Jul 6, 2016 at 17:36
  • Just go for the most no and the least possible yes. sudo nano /etc/ssh/sshd_config.d/50-redhat.conf; sudo systemctl restart sshd.service ChallengeResponseAuthentication no PasswordAuthentication no PermitEmptyPasswords no PubkeyAuthentication yes UsePAM no ...enables you to login with your private key only and even though the user has a password, the password login is always denied.
    – Alex
    Jul 5, 2021 at 0:25

According to this wiki page about SSH keys and this answer, you need to change these two lines in your sshd_config:

PasswordAuthentication no
ChallengeResponseAuthentication no
  • 3
    What difference does the second line about challenge response make? Jul 21, 2016 at 19:17
  • 2
    "It doesn't provide "additional security," per se. The term "ChallengeResponseAuthentication" is just an OpenSSH configuration keyword; it refers to the "keyboard-interactive" userauth method in the SSH protocol —Richard Silverman (fixunix.com)
    – pzkpfw
    May 22, 2017 at 9:23
  • For some reason, adding ChallengeResponseAuthentication no worked even after applying PasswordAuthentication no and PubkeyAuthentication yes Mar 28, 2021 at 18:37

In /etc/ssh/sshd_config, below settings worked for me:

PasswordAuthentication no
UsePAM no

Finally, restart sshd daemon.


The line you want is abnormally commented out by default in the sshd_config file.

# Change to no to disable tunnelled clear text passwords
--->#PasswordAuthentication yes

To disable passwords, change the yes to no and remove the comment:

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no

from https://www.ssh.com/ssh/copy-id#sec-How-ssh-copy-id-works: Generally, the user's home directory or any file or directory containing keys files should not be writable by anyone else. Otherwise someone else could add new authorized keys for the user and gain access. Private key files should not be readable by anyone else.

Try with sudo chmod go-rwx /home/username/ replacing username as appropriate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.