I followed the following guide:
But it is still possible to ssh into the machine by entering a password (tried on win with putty)
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It only takes a minute to sign up.Sign up to join this community
Before disabling ssh password authentication please make sure your access with private key works as expected. Once confirmed, you can disable password authentication. I'd suggest following changes to secure the server even more.
Edit file with:
sudo nano /etc/ssh/sshd_config
Please make sure you have following values enabled in the file:
PermitRootLogin no PasswordAuthentication no ChallengeResponseAuthentication no UsePAM no
Save file and then restart ssh service
sudo service ssh restart
sudo systemctl restart ssh
Edit: There is a question what these parameters do. Let's go through them one by one. For the most current version you can alway go to manual page OpenSSH SSH daemon configuration file
Specifies whether root can log in using ssh(1). The argument must be “yes”, “without-password”, “forced-commands-only”, or "no”. The default is “yes”. If this option is set to “without-password”, password authentication is disabled for root.
If this option is set to “forced-commands-only”, root login with public key authentication will be allowed, but only if the command option has been specified (which may be useful for taking remote backups even if root login is normally not allowed). All other authentication methods are disabled for root.
If this option is set to “no”, root is not allowed to log in.
Not permitting 'Root login' using password is considered stronger security than allowing it. That said, you should not be logging into root at all, unless no other method (sudo, etc.) will work.
Specifies whether password authentication is allowed. The default is “yes”.
This is basically it. If this is "no", you are not allowed to login using login and password but ... you can bypass it with other options so please read on.
Specifies whether challenge-response authentication is allowed (e.g. via PAM). The default is “yes”.
UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will enable PAM authentication using ChallengeResponseAuthentication and PasswordAuthentication in addition to PAM account and session module processing for all authentication types.
Because PAM challenge-response authentication usually serves an equivalent role to password authentication, you should disable either PasswordAuthentication or ChallengeResponseAuthentication. The default is “no”.
And in the end some info from Ubuntu manual linked above. The defaults may vary so if you want to secure your server, I'd recommend to use set those options mentioned at the top explicitly.
Note that the Debian openssh-server package sets several options as standard in /etc/ssh/sshd_config which are not the default in sshd(8). The exact list depends on whether the package was installed fresh or upgraded from various possible previous versions, but includes at least the following:
- ChallengeResponseAuthentication no
- X11Forwarding yes
- PrintMotd no
- AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server
- UsePAM yes