ssh - keys and password

Question

I've gotten keys (certificates) working correctly, but as it is, it's more of a "convenience" thing. (which I love). But as far as security, someone can still use a password to login. What's a good way to disable passwords and only allow certificate logins? I don't want to just choose a random password (which would probably work also), but I want to disable passwords entirely.

Ideas?

Answer 1

Edit your sshd_config (likely /etc/ssh/sshd_config, but varies) and change this:

PasswordAuthentication yes

To this:

PasswordAuthentication no

To make it live you will need to restart your sshd daemon.

For more generally useful sshd configuration information you can run the following:

man sshd_config

Answer 2

What Neil said is correct, but you can also do usermod -L username to disable a user's password, but not his key login. This puts a "!" in front of the hash in /etc/shadow. Public key auth still works when you do that.