There are three things that can cause it, and the two discussed by everyone else here don't cover a common scenario that's arising with AWS-deployed AMIs.
PasswordAuthentication no
- don't allow password authentication
or
ChallengeResponseAuthentication no
- don't challenge the user for authentication (could be password or other keyboard-interactive)
or
AuthenticationMethods publickey
- only allow someone to login after they've authed via publickey
Change these to:
PasswordAuthentication yes
- allow password authentication
and
ChallengeResponseAuthentication yes
- allow the user to be challenged
and
AuthenticationMethods any
- allow any valid form of authentication to succeed
I think you may find ChallengeResponseAuthentication yes
to be optional, I'm just including it here for thoroughness.