Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have configured an Ubuntu 10.04LTS desktop install to only allow public key authentication.

RESULT: public key authentication works perfectly!

QUESTION: The problem is that despite being configured to only accept public key authentication the client still accepts password authentication - why?

Sure could use some suggestions as I have seen and followed the suggestions here: ssh: can still use password after setting the key

No success after following these suggestions:

  • chmod 700 /home//.ssh
  • chmod 600 /home//.ssh/authorized_keys
  • added to /etc/ssh/ssh_config:
    • PasswordAuthentication no
    • ChallengeResponseAuthentication no
  • restarted sshd (command: /usr/sbin/service ssh restart).

The client's /etc/ssh/ssh_config reads:

# This is the ssh client system-wide configuration file.  See
# ssh_config(5) for more information.  This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.

# Configuration data is parsed as follows:
#  1. command line options
#  2. user-specific file
#  3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.

# Site-wide defaults for some commonly used options.  For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.

Host *
#   ForwardAgent no
#   ForwardX11 no
#   ForwardX11Trusted yes
#   RhostsRSAAuthentication no
    RSAAuthentication yes
    PasswordAuthentication no
    PermitRootLogin no
    PubKeyAuthentication yes
    ChallengeResponseAuthentication no
#   HostbasedAuthentication no
#   GSSAPIAuthentication no
#   GSSAPIDelegateCredentials no
#   GSSAPIKeyExchange no
#   GSSAPITrustDNS no
#   BatchMode no
#   CheckHostIP yes
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/identity
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   Port 22
#   Protocol 2,1
#   Cipher 3des
#   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-c                                                    bc,3des-cbc
#   MACs hmac-md5,hmac-sha1,,hmac-ripemd160
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
#   PermitLocalCommand no
#   VisualHostKey no
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials no

Am I missing another option? Match perhaps (though that seems unlikely to help to me)?


share|improve this question
Have you restarted ssh? – gravyface May 3 '11 at 15:51
yes - good idea though. First thing I tried. – rfreytag May 3 '11 at 15:57
up vote 10 down vote accepted

/etc/ssh/ssh_config is for the client. You want to set those options on the server config file, which is /etc/ssh/sshd_config.

share|improve this answer
Ah, good catch. – gravyface May 3 '11 at 16:00
I've been staring at this for too long to admit here. Just figured it out after I posted the Q. I figured someone else deserved the credit. Thank you! Lots more errors like this to come no doubt - stay tuned. (sigh) – rfreytag May 3 '11 at 16:09
You're welcome! – EEAA May 3 '11 at 16:28
Just been wondering why the hell my changes weren't making any difference and come across this... then went doh! – Andy Davies Aug 10 '12 at 14:11

I know this questions is really old, and has been answered, but since when I had this problem, this was the number one search result on google, I figured I'd put the information here.

For some reason after I changed

PasswordAuthentication yes


PasswordAuthentication no

in my sshd_config file, it was still asking for the password.

I had checked everything here, and I had also run

sudo /etc/init.d/ssh restart #or sshd

The changes to the config file just wouldn't make any difference, so I finally tried to just reboot the machine, and that worked. I guess the /etc/init.d/ssh restart wasn't working for some reason? Anyway, I hope this helps someone.

share|improve this answer

Try setting PreferredAuthentications to just publickey.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.