Skip to main content
Turn off SSH password login to protect your machine. A machine with it enabled will not pass verification. The steps are the same on Ubuntu Server 22.04 and 24.04.
Do not turn off password login until you have confirmed your key works. Step 2 is what stops you locking yourself out. Keep your current session open until the end.

​
1. Check the current setting

This asks sshd what it is actually using, with defaults and included files resolved.
If it already says no, you are done. If it says yes, continue.
A fresh Ubuntu install says yes. Ubuntu ships the setting commented out, and sshd enables password login when the setting is absent.

​
2. Add your key and confirm it works

From your own computer. Replace youruser with your login name on the machine and 1.2.3.4 with its IP address, here and in every command below.
Now open a second terminal, leaving the first one connected, and log in using only your key. This proves the key is what is getting you in.
You should get a shell prompt with no password asked.
If you get Permission denied (publickey), your key is not working. Stop here and fix it. Check that the key landed in ~/.ssh/authorized_keys on the host, and that ~/.ssh is mode 700 and authorized_keys is mode 600.

​
3. Turn off password login

Do not run this until step 2 worked. If your key is not accepted yet, this locks you out.
First save a copy of the config you have now. cp -n never overwrites, so it is safe to run this more than once.
Now set PasswordAuthentication no in the SSH config files that have it, including the extra files Ubuntu keeps in /etc/ssh/sshd_config.d/.
This catches commented lines, indented lines, and any file a cloud image left behind.

​
Or edit the config yourself

Open /etc/ssh/sshd_config and set:
Then check that nothing else overrides it:
Change any line that says yes to no. Files in that folder are read first, so they win over the main config.
Removing the # is not enough. The value must be no. A line reading PasswordAuthentication yes still allows passwords.

​
4. Apply and verify

sshd -t checks the config for errors. The && means the restart only runs if that check passes, so a broken config cannot take SSH down. Editing the config changes nothing until you restart.
No output means both worked. Existing sessions stay connected. Now confirm the running service is refusing passwords:
Once it says no, log in once more from your own computer to confirm, then close your original session. If it still says yes, most likely no config file had the setting. Add it, then restart and check again:
Once the output is passwordauthentication no, you are done. If your machine was flagged for password login, the error clears within about two hours.

​
If you are locked out

You need access that does not go through SSH. Use the machine’s IPMI, iDRAC, iLO, or other BMC console, or plug a monitor and keyboard into it. Then put back every copy you saved in step 3, and restart:
Restoring only /etc/ssh/sshd_config is not enough. The files in /etc/ssh/sshd_config.d/ are read first, so they keep password login off until they are restored too. Log in with your password, fix your key, and start again at step 2. Password login has to go back off before the machine will verify.