Skip to main content
To disable SSH password authentication, create /etc/ssh/sshd_config.d/00-disable-passwords.conf containing PasswordAuthentication no and KbdInteractiveAuthentication no, check the config with sudo sshd -t, then restart SSH with sudo systemctl restart ssh (Ubuntu/Debian) or sudo systemctl restart sshd (AlmaLinux/Rocky). Confirm a key login works first and keep your current session open until you have tested a new one.

​
Before you start

  • You must already log in with an SSH key. If you haven’t set one up, follow create and use SSH keys first.
  • Test it: ssh -o PasswordAuthentication=no alex@203.0.113.10 must log you in.
  • Keep one SSH session open the whole time. It stays connected when you restart SSH and is your way back if something goes wrong.
  • Commands use sudo. If you are logged in as root, leave sudo out.
If you disable passwords before your key works, you lock yourself out. On a VPS, recover through the VNC console or rescue mode. On a dedicated server, open a ticket.

​
Why use a file in sshd_config.d?

Current Ubuntu, Debian, AlmaLinux and Rocky Linux releases start /etc/ssh/sshd_config with Include /etc/ssh/sshd_config.d/*.conf. OpenSSH uses the first value it reads for each setting, and included files are read in alphabetical order. Many server images ship a file such as 50-cloud-init.conf that sets PasswordAuthentication yes. A file whose name starts with 00- is read before it, so your setting wins, and package updates don’t overwrite it.

​
How to disable password login

1

Check what is set now

The first command shows the settings SSH actually uses. The second shows which files set them.
2

Create the override file

Add these lines, then save with Ctrl+O and exit with Ctrl+X:
KbdInteractiveAuthentication covers the “keyboard-interactive” method, which can also ask for a password. Turning off both stops all password prompts.
3

Test the configuration

No output means the syntax is valid. Fix any error it prints before you continue.
4

Restart SSH

Your open session stays connected.
5

Test from a new window

Open a second terminal and log in with your key. It should work as before.

​
How to check it worked

Confirm the active settings:
From your computer, try to log in without a key:
The server now refuses without asking for a password:

​
How to turn password login back on

Delete the file and restart SSH:
Use sshd instead of ssh in the restart command on AlmaLinux and Rocky Linux.

​
Frequently asked questions

​
I set PasswordAuthentication no but passwords still work. Why?

Another file sets it to yes first, usually a 50-cloud-init.conf in /etc/ssh/sshd_config.d/, or a line near the top of sshd_config. Run sudo sshd -T | grep passwordauthentication to see the value SSH really uses, and make sure your file name sorts first.

​
Does this also block root logging in with a password?

Yes, it blocks password logins for every user, including root. To stop root logging in at all, see disable root login over SSH.

​
Can I still use the VNC console with a password?

Yes. This setting only affects SSH. The VNC console is a local login and still accepts your password.

​
Do I still need Fail2ban after disabling passwords?

Password guessing can no longer succeed, but bots still fill your logs. Fail2ban or CrowdSec blocks them early.

VPS and dedicated server guides

Every guide in this section.

Create and use SSH keys

Set up key login first.

Change the SSH port

Cut down automated scans.

Disable root login

Log in as a normal user instead.

Linux security checklist

Everything to harden on a new server.
Checked against the official OpenSSH sshd_config manual on 4 November 2026; the drop-in file, sshd -t, sshd -T and the refused password login were tested with OpenSSH 9.6 on Ubuntu 24.04 LTS. File names in sshd_config.d can differ between server images.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026