I followed the following guide:

But it is still possible to ssh into the machine by entering a password (tried on win with putty)

Any advice?

  • Have you restart your ssh server? Mar 17, 2014 at 20:25
  • 1
    sudo /etc/init.d/ssh reload
    – noob
    Mar 17, 2014 at 20:27
  • please mark an answer if it worked
    – Efren
    Sep 3, 2018 at 4:33

2 Answers 2


After you replaced the line:

#PasswordAuthentication yes

with the line:

PasswordAuthentication no

in /etc/ssh/sshd_config and you saved the file, you have to restart your ssh server using the following command in terminal:

sudo service ssh restart


sudo restart ssh

==== Important note!

Password authentication is ENABLED by default (as of January 2024) by the setting at the file /etc/ssh/sshd_config.d/50-cloud-init.conf. You MUST change the setting at this file or remove the file: rm /etc/ssh/sshd_config.d/50-cloud-init.conf as suggested in the comments below in order to disable password authentication

  • is this not the same: sudo /etc/init.d/ssh reload
    – noob
    Mar 17, 2014 at 20:31
  • @noob As you can see, is not the same. Mar 17, 2014 at 20:34
  • What is the difference between restarting ssh service and restarting sshd service? Why do we want to restart ssh instead of sshd?
    – Hatshepsut
    Sep 14, 2016 at 16:58
  • 2
    @Hatshepsut: it's an Ubuntu thing, and it's damn annoying. On Red Hat based systems, it's 'service sshd'
    – Dmitri
    Nov 21, 2016 at 6:18
  • 4
    on ubuntu22, maybe need rm /etc/ssh/sshd_config.d/50-cloud-init.conf
    – yurenchen
    Jul 29, 2023 at 18:12

Before disabling ssh password authentication please make sure your access with private key works as expected. Once confirmed, you can disable password authentication. I'd suggest following changes to secure the server even more.

Edit file with: sudo nano /etc/ssh/sshd_config

Please make sure you have following values enabled in the file:

PermitRootLogin no

PasswordAuthentication no

ChallengeResponseAuthentication no

UsePAM no

Save file and then restart ssh service

sudo service ssh restart


sudo systemctl restart ssh

Edit: There is a question what these parameters do. Let's go through them one by one. For the most current version you can alway go to manual page OpenSSH SSH daemon configuration file

1. PermitRootLogin

Specifies whether root can log in using ssh(1). The argument must be “yes”, “without-password”, “forced-commands-only”, or "no”. The default is “yes”. If this option is set to “without-password”, password authentication is disabled for root.

If this option is set to “forced-commands-only”, root login with public key authentication will be allowed, but only if the command option has been specified (which may be useful for taking remote backups even if root login is normally not allowed). All other authentication methods are disabled for root.

If this option is set to “no”, root is not allowed to log in.

Not permitting 'Root login' using password is considered stronger security than allowing it. That said, you should not be logging into root at all, unless no other method (sudo, etc.) will work.

2. PasswordAuthentication

Specifies whether password authentication is allowed. The default is “yes”.

This is basically it. If this is "no", you are not allowed to login using login and password but ... you can bypass it with other options so please read on.

3. ChallengeResponseAuthentication

Specifies whether challenge-response authentication is allowed (e.g. via PAM). The default is “yes”.

4. UsePAM

UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will enable PAM authentication using ChallengeResponseAuthentication and PasswordAuthentication in addition to PAM account and session module processing for all authentication types.

Because PAM challenge-response authentication usually serves an equivalent role to password authentication, you should disable either PasswordAuthentication or ChallengeResponseAuthentication. The default is “no”.

And in the end some info from Ubuntu manual linked above. The defaults may vary so if you want to secure your server, I'd recommend to use set those options mentioned at the top explicitly.

Note that the Debian openssh-server package sets several options as standard in /etc/ssh/sshd_config which are not the default in sshd(8). The exact list depends on whether the package was installed fresh or upgraded from various possible previous versions, but includes at least the following:

  • ChallengeResponseAuthentication no
  • X11Forwarding yes
  • PrintMotd no
  • AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server
  • UsePAM yes
  • 6
    Could you explain what these settings do?
    – php_nub_qq
    Nov 1, 2019 at 14:39
  • These will have to be turned off if for example you're running ansible with -u root. I would opt to keep password auth off and set key auth on. Dec 5, 2021 at 22:22
  • I tried your steps but I get the permission issue Permission denied (publickey) Nov 22, 2022 at 3:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .