iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To disable SSH password login without losing access, first prove that key-based login works in a second terminal and keep your existing session open. Then set PasswordAuthentication no and KbdInteractiveAuthentication no, validate the SSH daemon configuration, reload the correct service, and test both key and password authentication.
What disabling SSH passwords actually changes
OpenSSH has more than one authentication path that can result in a password prompt. PasswordAuthentication controls the traditional SSH password method. KbdInteractiveAuthentication controls keyboard-interactive authentication, which can be backed by PAM and may also ask for a password.
Free tools Windows power users keep installed
One-click scans. No signup required.
Setting only PasswordAuthentication no can therefore leave a PAM-backed password prompt available through keyboard-interactive authentication. For a key-only server, disable both methods and explicitly allow public-key authentication:
PasswordAuthentication no
PubkeyAuthentication yes
KbdInteractiveAuthentication noThe OpenSSH manual lists PasswordAuthentication as enabled by default. The OpenBSD manual lists KbdInteractiveAuthentication as enabled by default and specifies that it accepts only yes or no. Distribution packages can change those defaults; for example, Debian’s packaged configuration sets some options differently from the daemon’s built-in defaults. Always check the effective configuration on your VPS rather than assuming the defaults.
#1 Best Overall
- 【Strong Adsorption】The inspiration of the silicone phone suction case comes from the adhesive force of the octopus. Each suction cup phone mount is 3.15 inches long and 2.17 inches wide, with 24 independent suction cups providing a stronger and more stable suction force, so you don't have to worry about your phone falling during use.
- 【Back of Phone Suction Grip】Remove the adhesive film on the phone suction cup and stick it on the phone case. You can then fix the phone on any smooth surface, which is very convenient. (The phone suction cup cannot be removed and reused after being attached to the phone case. It is recommended to attach it to a regular phone case, not a valuable one.)
- 【Widely Used】Our non-slip silicone phone sticky grip mount attaches to almost any flat phone case and make it compatible with common mobile phones such as iPhone and Android.You can shoot, watch videos or video calls in the kitchen, gym, dance studio, bathroom and other places.
- 【Capture the Wonderful Picture】Whether you are a TikTok creator or just like to share videos and photos, this phone suction cup can help you hands-free capture wonderful videos and photos for sharing with friends.
- 【Note】You can fix the phone suction cup on a smooth surface such as a mirror or glass. If necessary, wipe the suction cup with a damp cloth to obtain stronger suction. Before releasing your hand, make sure the phone is firmly fixed. (Not applicable to rough walls, wooden surfaces, and other uneven surfaces)
Before you change SSH: prevent a lockout
Keep the current session open
Do not close your working SSH window while changing authentication. If the new configuration is rejected or your key test fails, that session is your easiest way to correct the file and reload SSH.
Test a key from a second terminal
From another local terminal, connect using the key that you intend to keep using:
Recommended Free Tools
ssh -i ~/.ssh/id_ed25519 your-user@your-serverReplace the identity-file path, user name, and server address with your values. Confirm that this second connection reaches a shell without asking for the account password. If it does not, fix key access before disabling passwords. Check that the public key is present in the target account’s ~/.ssh/authorized_keys, that you are using the correct user, and that your client is selecting the expected private key.
Have an out-of-band recovery path
Know how to reach your VPS provider’s serial console, web console, or rescue environment before making the change. If every SSH session is lost, an out-of-band console is normally the way to repair the configuration. Provider-specific console names and availability vary, so do not assume one exists for every VPS plan.
Inspect the configuration that is already in use
OpenSSH can read the main file and additional files from /etc/ssh/sshd_config.d/. Search both locations for password-related directives:
sudo grep -rni 'passwordauthentication' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/Also look for keyboard-interactive and public-key settings:
Rank #2
- SUPERIOR COMFORT — Unlike traditional circular ear buds, the design of EarPods is defined by the geometry of the ear. Which makes them more comfortable for more people than any other ear bud–style headphones.
- HIGH-QUALITY AUDIO — The speakers inside EarPods have been engineered to maximize sound output and minimize sound loss, which means you get high-quality audio.
- BUILT-IN REMOTE — EarPods with USB-C plug also include a built-in remote that lets you adjust the volume, control the playback of music and video, and answer or end calls with a pinch of the cord.
- COMPATIBILITY — Works with all devices that have a USB-C port.
- INTEGRATED MICROPHONE — A built-in microphone precisely captures your voice while you’re on the phone, taking a FaceTime call, or summoning Siri — so you’re always heard loud and clear.
sudo grep -rniE 'kbdinteractiveauthentication|pubkeyauthentication|permitrootlogin' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/A commented line is not an active setting. Duplicate active directives can be confusing because OpenSSH generally uses the first value it reads for a keyword. An early drop-in is useful only when it is read before another active value; verify the result with sshd -T instead of relying on file names alone.
Display the effective values
Run:
sudo sshd -T | grep -iE 'passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication|permitrootlogin'This asks the daemon to parse its configuration and print the resulting values. It is more useful than reading one file because it includes settings inherited from included files. If your configuration uses conditional Match blocks, the result can depend on the connection context; evaluate the relevant context when checking a rule that is conditional on user, address, or group.
Apply a key-only policy with a drop-in file
1. Create an explicit drop-in
On systems that load /etc/ssh/sshd_config.d/, create a clearly named file:
sudo tee /etc/ssh/sshd_config.d/00-disable-password-authentication.conf > /dev/null <<'EOF'
PasswordAuthentication no
PubkeyAuthentication yes
KbdInteractiveAuthentication no
EOFThe 00- prefix makes the intended order obvious. It does not override a directive that the daemon has already read earlier, so inspect the include order and confirm the effective result afterward. If your distribution does not load the drop-in directory, place the same directives in /etc/ssh/sshd_config instead, taking care not to leave an earlier conflicting value.
2. Check syntax before reloading
Run the daemon’s configuration test:
sudo sshd -tNo output and a successful exit status indicate that the syntax check passed. A message identifies the file and line that need correction. Do not reload SSH until this command succeeds.
3. Reload the SSH service
Reload the daemon so existing sessions stay open while new connections use the policy. On Debian- and Ubuntu-family systems the unit is commonly named ssh:
Rank #3
- Secure Hold: Our PopSockets adhesive phone grip gives your cell phone a secure, comfortable hold in hand to help prevent drops while texting, taking photos, or scrolling on the go. Designed to stick firmly to most phone cases and devices.
- Hands-Free Made Easy: Easily turn your PopSocket into a phone stand to prop up your phone anywhere, perfect for watching videos, video calls, or following recipes. A must-have phone holder that keeps your device secure and ready for anything.
- Compatibility: Works with all phones, tablets, and Kindles. Sticks best to smooth, hard plastic cases and may not adhere to silicone or textured cases. Easily swap your PopTop to change up your style.
- Black PopSockets: Simple, refined, and endlessly versatile. A timeless essential for any phone.
- Travel Must-Have for People On the Go: A must-have travel accessory for flights, flying, airports, air travel, airplanes, planes, international trips, cruises, and long travel days. Key gadget for your airport haul, travel accessories and must-haves.
sudo systemctl reload sshOn many RHEL-family systems it is commonly named sshd:
sudo systemctl reload sshdThe service name is distribution-specific. If a reload command reports that the unit does not exist, identify the installed unit with your system’s service manager rather than guessing. A reload failure should be treated as a configuration problem; inspect the service status and journal while your current session remains open.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Confirm what the daemon accepted
After the reload, check the effective values again:
sudo sshd -T | grep -iE 'passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication'You should see:
passwordauthentication nokbdinteractiveauthentication nopubkeyauthentication yes
If any value differs, find the earlier or conditional directive that wins, correct the configuration, run sshd -t again, and reload only after the test passes.
Verify both sides of the change
Confirm key authentication still works
Open another terminal and make a normal connection with the approved key:
ssh -i ~/.ssh/id_ed25519 your-user@your-serverUse a fresh connection, not the session that was already open before the reload. A pre-existing session does not prove that new authentication attempts are accepted.
Rank #4
- [360 ° Flexible Rotation Design] Comes with a rotatable lanyard ring that supports 360 ° free rotation, effectively solving the problem of twisted and tangled lanyards
- [Wide compatibility] The ultra-thin 0.02-inch design does not block the charging port at all, and both wired and wireless charging can be used directly without removing the pad. Compatible with most smartphones such as iPhone, compatible with various wristbands, lanyards, crossbody straps, and keychains
- [Durable and Portable Material] Premium rust-resistant stainless steel material with good flexibility, which not only avoids scratching the phone case, but also has excellent anti rust and anti fading performance
- [Multi scenario Practical] Paired with a lanyard or wristband, hands-free use can be achieved. The phone is within reach and not easily dropped, ideal for daily commuting and outdoor activities. Suitable for full coverage phone cases, does not support half coverage phone cases
- [Quality Service] If you find any damage or other issues with the product upon receipt, please contact us immediately. We will handle it quickly
Prove that password authentication is rejected
Test from a separate terminal with password authentication explicitly requested:
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no your-user@your-serverThe connection should fail without offering a password login. This test must not be performed by closing your only working session first. A server may still offer other methods if they are configured, so inspect the client output and the server’s effective values if the result is unexpected.
Check the server log when the result is unclear
Authentication failures are normally recorded by the system’s SSH or authentication logging. The exact log file and journal unit vary by distribution. Review the entries generated by your test connection from the open session or console, taking care not to paste private keys or sensitive account data into support channels.
PasswordAuthentication versus keyboard-interactive authentication
| Setting | Purpose | Key-only recommendation | Important qualification |
|---|---|---|---|
PasswordAuthentication |
Traditional SSH password authentication. | no |
The OpenSSH manual’s default is yes, although a distribution package may set another value. |
KbdInteractiveAuthentication |
Keyboard-interactive challenges, often supplied through PAM. | no |
The OpenBSD manual states that the value must be yes or no and gives a default of yes. |
PubkeyAuthentication |
Authentication with an SSH public/private key pair. | yes |
Enabling it does not make a key valid; the account still needs a matching authorized public key and usable file permissions. |
Do not change UsePAM merely because you are disabling password login. Some third-party instructions recommend UsePAM no, but PAM can govern other login behavior as well. Leave it as configured unless you have a specific, tested reason to change it and understand the effects on your distribution.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Decide whether root should be allowed over SSH
Password disabling and root-login policy are related but separate controls. PermitRootLogin accepts these values:
| Value | Effect for root SSH login |
|---|---|
yes |
Allows root login using permitted authentication methods. |
prohibit-password |
Blocks password and keyboard-interactive authentication for root but can allow key authentication. |
forced-commands-only |
Restricts root keys to forced commands; it is intended for narrowly defined automation. |
no |
Disables root SSH login entirely. |
The OpenSSH default is prohibit-password. If administrators should connect as an unprivileged account and use sudo, set PermitRootLogin no. If you deliberately require root key access for a recovery or automation workflow, prohibit-password keeps root key-only while rejecting root passwords. Test the chosen policy with the exact account and key before ending the current session.
Best Value
- 【PKYAA Double Sided Silicone Suction Phone Case Mount】PKYAA With Double Sided 40 Strong and Reliable individual suction cups, PKYAA provides a thicken and upgraded universal silicon suction mount for your phone.
- 【Friendly to Content Creators】If you are a content creator or an online influencer, you can create videos anywhere with this suction mount completely hands free with this silicone cell phone mount for cases.
- 【HANDS-FREE & Adhere to Mirrors】This Double Sided silicone suction phone case mount allows you to stick your phone to the mirror easily. No longer holding your phone in one hand to watch video tutorials while making up.
- 【Strong Grip on the Smooth Surface】You can easily hang your phone anywhere with a smooth surface. All you do is you clean off your phone and smooth surface. It is STURDY and it not only sticks to mirrors, it also sticks to windows, it sticks to refrigerators, tiles and other clean, flat surfaces.
- 【Press Down Firmly Every 30 Minutes】Use your palm or fingers to press the phone down firmly and check it's secure before letting go. Apply even pressure for a few seconds to allow the suction cup to adhere properly. To maintain the grip and prevent accidental falls, it's a good practice to periodically reapply pressure to the suction cup.
Drop-in file or main sshd_config?
| Approach | Advantages | Risks and checks |
|---|---|---|
Drop-in under /etc/ssh/sshd_config.d/ |
Separates local policy from the vendor-managed main file and is easier to identify during upgrades. | Only works if the main configuration includes the directory. Because the first value read can win, verify include order and run sshd -T. |
Edit /etc/ssh/sshd_config |
Works on installations without a drop-in directory and makes the setting visible in one file. | Packaged changes or manual edits can introduce duplicate directives. Search for every active occurrence and validate before reload. |
Whichever method you use, keep one authoritative active value for each authentication setting. Comments can document why passwords were disabled, but they do not change daemon behavior.
Troubleshooting common failures
sshd -t reports an error
Read the reported path and line number. Typical causes include a misspelled keyword, an unsupported value, a malformed include, or a file that the daemon cannot read. Correct the specific error, rerun sudo sshd -t, and do not reload a configuration that still fails validation.
Password login still succeeds
- Run
sudo sshd -T | grep -iE 'passwordauthentication|kbdinteractiveauthentication'. - If either value is
yes, search all files again for active duplicates. - Check whether an earlier directive is read before your drop-in.
- Check conditional
Matchrules that apply to the tested user or source address. - After correcting the winning value, validate and reload, then create a new test connection.
Do not infer the result from an existing connection; authentication settings are evaluated when a new session is established.
The client still receives a password-style prompt
Keyboard-interactive authentication is the first item to check. Confirm that kbdinteractiveauthentication no is effective. If it is already disabled, inspect the client’s offered methods and any other authentication mechanism configured on the server. Keep the current session and console access available while investigating.
Key login fails after passwords are disabled
Reconnect through the open session or out-of-band console and verify the key’s user account, authorized_keys entry, and client identity-file selection. Check the server’s authentication log for the reason. A key that was never tested in a new terminal is not a safe recovery method.
The service will not reload
Run sudo sshd -t first, then inspect the service status and journal for the unit name used by your distribution. Do not repeatedly restart the daemon while troubleshooting; a restart can terminate existing sessions and remove your easiest recovery path.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How to roll back safely
If a test reveals a problem, restore access while the original session or console is available:
- Open the drop-in for editing, for example
sudo nano /etc/ssh/sshd_config.d/00-disable-password-authentication.conf. - Temporarily correct or remove the offending directive. Do not erase unrelated administrator settings.
- Run
sudo sshd -tuntil it succeeds. - Reload the appropriate service.
- Retest key login before attempting any further hardening.
When a drop-in is the only change and you need to revert it completely, remove that file, validate the remaining configuration, and reload. Re-enabling password authentication should be a deliberate temporary recovery action, followed by another tested key-only change.
Quick Recap
Operational checklist
- Keep one authenticated SSH session open.
- Verify a new key-based connection from a second terminal.
- Confirm which files and conditional blocks define the current policy.
- Set
PasswordAuthentication no,KbdInteractiveAuthentication no, andPubkeyAuthentication yes. - Run
sudo sshd -tbefore every reload. - Reload the correct service for the distribution.
- Confirm the effective values with
sudo sshd -T. - Test a fresh key connection and a deliberately password-only connection.
- Choose a separate
PermitRootLoginpolicy and test it independently. - Keep an out-of-band console path available for future changes.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
