> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Disable SSH Password Authentication on Linux

> Disable SSH password authentication: set PasswordAuthentication no and KbdInteractiveAuthentication no in a sshd_config.d file, test with sshd -t, then restart SSH.

To disable SSH password authentication, create `/etc/ssh/sshd_config.d/00-disable-passwords.conf` containing `PasswordAuthentication no` and `KbdInteractiveAuthentication no`, check the config with `sudo sshd -t`, then restart SSH with `sudo systemctl restart ssh` (Ubuntu/Debian) or `sudo systemctl restart sshd` (AlmaLinux/Rocky). Confirm a key login works first and keep your current session open until you have tested a new one.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Intermediate | 10 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux and Rocky Linux 9 / 10 | Working SSH key login, root or sudo access |

## Before you start

* You must already log in with an SSH key. If you haven't set one up, follow [create and use SSH keys](https://help.freakhosting.com/portals/other/how-to-create-and-use-ssh-keys.md) first.
* Test it: `ssh -o PasswordAuthentication=no alex@203.0.113.10` must log you in.
* Keep one SSH session open the whole time. It stays connected when you restart SSH and is your way back if something goes wrong.
* Commands use `sudo`. If you are logged in as root, leave `sudo` out.

> [!WARNING]
>
> If you disable passwords before your key works, you lock yourself out. On a VPS, recover through the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) or [rescue mode](https://help.freakhosting.com/portals/vps-panel/how-to-use-rescue-mode.md). On a dedicated server, [open a ticket](https://freakhosting.com/clientarea/submitticket.php).

## Why use a file in sshd\_config.d?

Current Ubuntu, Debian, AlmaLinux and Rocky Linux releases start `/etc/ssh/sshd_config` with `Include /etc/ssh/sshd_config.d/*.conf`. OpenSSH uses the **first** value it reads for each setting, and included files are read in alphabetical order. Many server images ship a file such as `50-cloud-init.conf` that sets `PasswordAuthentication yes`. A file whose name starts with `00-` is read before it, so your setting wins, and package updates don't overwrite it.

## How to disable password login

**1. Check what is set now**

```bash theme={null}
sudo sshd -T | grep -E '^(passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication) '
grep -ri passwordauthentication /etc/ssh/sshd_config /etc/ssh/sshd_config.d/
```

The first command shows the settings SSH actually uses. The second shows which files set them.

**2. Create the override file**

```bash theme={null}
sudo nano /etc/ssh/sshd_config.d/00-disable-passwords.conf
```

Add these lines, then save with **Ctrl+O** and exit with **Ctrl+X**:

```ini theme={null}
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
```

`KbdInteractiveAuthentication` covers the "keyboard-interactive" method, which can also ask for a password. Turning off both stops all password prompts.

**3. Test the configuration**

```bash theme={null}
sudo sshd -t
```

No output means the syntax is valid. Fix any error it prints before you continue.

**4. Restart SSH**

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> sudo systemctl restart ssh
> ```

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> sudo systemctl restart sshd
> ```

Your open session stays connected.

**5. Test from a new window**

Open a **second** terminal and log in with your key. It should work as before.

## How to check it worked

Confirm the active settings:

```bash theme={null}
sudo sshd -T | grep -E '^(passwordauthentication|kbdinteractiveauthentication) '
```

```text theme={null}
passwordauthentication no
kbdinteractiveauthentication no
```

From your computer, try to log in without a key:

```bash theme={null}
ssh -o PubkeyAuthentication=no alex@203.0.113.10
```

The server now refuses without asking for a password:

```text theme={null}
alex@203.0.113.10: Permission denied (publickey).
```

## How to turn password login back on

Delete the file and restart SSH:

```bash theme={null}
sudo rm /etc/ssh/sshd_config.d/00-disable-passwords.conf
sudo sshd -t && sudo systemctl restart ssh
```

Use `sshd` instead of `ssh` in the restart command on AlmaLinux and Rocky Linux.

## Frequently asked questions

### I set PasswordAuthentication no but passwords still work. Why?

Another file sets it to `yes` first, usually a `50-cloud-init.conf` in `/etc/ssh/sshd_config.d/`, or a line near the top of `sshd_config`. Run `sudo sshd -T | grep passwordauthentication` to see the value SSH really uses, and make sure your file name sorts first.

### Does this also block root logging in with a password?

Yes, it blocks password logins for every user, including root. To stop root logging in at all, see [disable root login over SSH](https://help.freakhosting.com/portals/other/how-to-disable-root-login-over-ssh.md).

### Can I still use the VNC console with a password?

Yes. This setting only affects SSH. The [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) is a local login and still accepts your password.

### Do I still need Fail2ban after disabling passwords?

Password guessing can no longer succeed, but bots still fill your logs. [Fail2ban](https://help.freakhosting.com/portals/other/how-to-set-up-fail2ban-for-ssh-on-ubuntu.md) or [CrowdSec](https://help.freakhosting.com/portals/other/how-to-install-crowdsec-on-linux.md) blocks them early.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Create and use SSH keys](https://help.freakhosting.com/portals/other/how-to-create-and-use-ssh-keys.md)
>
> Set up key login first.

> [card] [Change the SSH port](https://help.freakhosting.com/portals/other/how-to-change-the-ssh-port.md)
>
> Cut down automated scans.

> [card] [Disable root login](https://help.freakhosting.com/portals/other/how-to-disable-root-login-over-ssh.md)
>
> Log in as a normal user instead.

> [card] [Linux security checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md)
>
> Everything to harden on a new server.

***

> [!NOTE]
>
> **Checked against the official [OpenSSH sshd\_config manual](https://man.openbsd.org/sshd_config)** on 4 November 2026; the drop-in file, `sshd -t`, `sshd -T` and the refused password login were tested with OpenSSH 9.6 on Ubuntu 24.04 LTS. File names in `sshd_config.d` can differ between server images.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.