> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vast.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Disable SSH Password Login

> Turn off SSH password login to protect your machine.

Turn off SSH password login to protect your machine. A machine with it enabled
will not pass verification.

The steps are the same on Ubuntu Server 22.04 and 24.04.

<Warning>
  Do not turn off password login until you have confirmed your key works. Step 2
  is what stops you locking yourself out. Keep your current session open until the
  end.
</Warning>

## 1. Check the current setting

This asks sshd what it is actually using, with defaults and included files
resolved.

```bash theme={null}
sudo sshd -T | grep passwordauthentication
```

```
passwordauthentication yes
```

If it already says `no`, you are done. If it says `yes`, continue.

<Note>
  A fresh Ubuntu install says `yes`. Ubuntu ships the setting commented out, and
  sshd enables password login when the setting is absent.
</Note>

## 2. Add your key and confirm it works

From your own computer. Replace `youruser` with your login name on the machine
and `1.2.3.4` with its IP address, here and in every command below.

```bash theme={null}
ssh-copy-id youruser@1.2.3.4
```

```
Number of key(s) added: 1
```

Now open a second terminal, leaving the first one connected, and log in using
only your key. This proves the key is what is getting you in.

```bash theme={null}
ssh -o PreferredAuthentications=publickey youruser@1.2.3.4
```

You should get a shell prompt with no password asked.

<Warning>
  If you get `Permission denied (publickey)`, your key is not working. Stop here
  and fix it. Check that the key landed in `~/.ssh/authorized_keys` on the host,
  and that `~/.ssh` is mode `700` and `authorized_keys` is mode `600`.
</Warning>

## 3. Turn off password login

<Warning>
  Do not run this until step 2 worked. If your key is not accepted yet, this locks
  you out.
</Warning>

First save a copy of the config you have now. `cp -n` never overwrites, so it is
safe to run this more than once.

```bash theme={null}
sudo cp -n /etc/ssh/sshd_config /etc/ssh/sshd_config.orig
sudo sh -c 'for f in /etc/ssh/sshd_config.d/*.conf; do cp -n "$f" "$f.orig"; done'
```

Now set `PasswordAuthentication no` in the SSH config files that have it,
including the extra files Ubuntu keeps in `/etc/ssh/sshd_config.d/`.

```bash theme={null}
sudo sed -i -E 's/^[[:space:]]*#?[[:space:]]*(PasswordAuthentication)[[:space:]]+.*/\1 no/I' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf 2>/dev/null
```

```
(no output)
```

This catches commented lines, indented lines, and any file a cloud image left
behind.

### Or edit the config yourself

Open `/etc/ssh/sshd_config` and set:

```
PasswordAuthentication no
```

Then check that nothing else overrides it:

```bash theme={null}
sudo grep -r -i passwordauthentication /etc/ssh/sshd_config.d/ 2>/dev/null
```

Change any line that says `yes` to `no`. Files in that folder are read first, so
they win over the main config.

<Warning>
  Removing the `#` is not enough. The value must be `no`. A line reading
  `PasswordAuthentication yes` still allows passwords.
</Warning>

## 4. Apply and verify

`sshd -t` checks the config for errors. The `&&` means the restart only runs if
that check passes, so a broken config cannot take SSH down. Editing the config
changes nothing until you restart.

```bash theme={null}
sudo sshd -t && sudo systemctl restart ssh.service
```

No output means both worked. Existing sessions stay connected.

Now confirm the running service is refusing passwords:

```bash theme={null}
sudo sshd -T | grep passwordauthentication
```

```
passwordauthentication no
```

Once it says `no`, log in once more from your own computer to confirm, then
close your original session.

If it still says `yes`, most likely no config file had the setting. Add it,
then restart and check again:

```bash theme={null}
echo "PasswordAuthentication no" | sudo tee -a /etc/ssh/sshd_config
sudo sshd -t && sudo systemctl restart ssh.service
sudo sshd -T | grep passwordauthentication
```

<Check>
  Once the output is `passwordauthentication no`, you are done. If your machine
  was flagged for password login, the error clears within about two hours.
</Check>

## If you are locked out

You need access that does not go through SSH. Use the machine's IPMI, iDRAC, iLO,
or other BMC console, or plug a monitor and keyboard into it. Then put back
every copy you saved in step 3, and restart:

```bash theme={null}
sudo sh -c 'for f in /etc/ssh/sshd_config.orig /etc/ssh/sshd_config.d/*.orig; do [ -e "$f" ] && cp "$f" "${f%.orig}"; done'
sudo sshd -t && sudo systemctl restart ssh.service
```

Restoring only `/etc/ssh/sshd_config` is not enough. The files in
`/etc/ssh/sshd_config.d/` are read first, so they keep password login off until
they are restored too.

Log in with your password, fix your key, and start again at step 2. Password
login has to go back off before the machine will verify.