Pubkey authentication is stronger because the AAA hinges on a keypair, in effect a mathematical identity, rather than a string of characters (the password). One must possess the public portion to succeed in auth, and you cant just lean over a shoulder or get it with a rubber hose. As for the comment about MITM...well, ssh doesn't transmit passwords in the clear.
Of course, there is more you can do here beyond pubkeys:
- Limit the source IP's that can connect to that system
- host firewall
- TCP Wrappers
- Reverse Proxy
- Use 'AllowUsers' and 'Allowgroups' in sshd_config
- Use PAM, there are various modules that apply more security filteration
- Require pubkey auth as well as password,
- Set 'PermitRootLogin No' in sshd_config
- Set your 'ServerKeyBits' to 2048 in sshd_config
- Generate your pubkeys as 2048-bit or larger
Alternatives to pubkey auth?
- Use S/MIME, generate a list of one-time-passwords