I have configured an Ubuntu 10.04LTS desktop install to only allow public key authentication.

RESULT: public key authentication works perfectly!

QUESTION: The problem is that despite being configured to only accept public key authentication the client still accepts password authentication - why?

Sure could use some suggestions as I have seen and followed the suggestions here: ssh: can still use password after setting the key

No success after following these suggestions:

  • chmod 700 /home//.ssh
  • chmod 600 /home//.ssh/authorized_keys
  • added to /etc/ssh/ssh_config:
    • PasswordAuthentication no
    • ChallengeResponseAuthentication no
  • restarted sshd (command: /usr/sbin/service ssh restart).

The client's /etc/ssh/ssh_config reads:

# This is the ssh client system-wide configuration file.  See
# ssh_config(5) for more information.  This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.

# Configuration data is parsed as follows:
#  1. command line options
#  2. user-specific file
#  3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.

# Site-wide defaults for some commonly used options.  For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.

Host *
#   ForwardAgent no
#   ForwardX11 no
#   ForwardX11Trusted yes
#   RhostsRSAAuthentication no
    RSAAuthentication yes
    PasswordAuthentication no
    PermitRootLogin no
    PubKeyAuthentication yes
    ChallengeResponseAuthentication no
#   HostbasedAuthentication no
#   GSSAPIAuthentication no
#   GSSAPIDelegateCredentials no
#   GSSAPIKeyExchange no
#   GSSAPITrustDNS no
#   BatchMode no
#   CheckHostIP yes
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/identity
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   Port 22
#   Protocol 2,1
#   Cipher 3des
#   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-c                                                    bc,3des-cbc
#   MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
#   PermitLocalCommand no
#   VisualHostKey no
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials no

Am I missing another option? Match perhaps (though that seems unlikely to help to me)?


  • Have you restarted ssh?
    – gravyface
    May 3, 2011 at 15:51
  • yes - good idea though. First thing I tried.
    – rfreytag
    May 3, 2011 at 15:57

4 Answers 4


/etc/ssh/ssh_config is for the client. You want to set those options on the server config file, which is /etc/ssh/sshd_config.


I know this questions is really old, and has been answered, but since when I had this problem, this was the number one search result on google, I figured I'd put the information here.

For some reason after I changed

PasswordAuthentication yes


PasswordAuthentication no

in my sshd_config file, it was still asking for the password.

I had checked everything here, and I had also run

sudo /etc/init.d/ssh restart #or sshd

The changes to the config file just wouldn't make any difference, so I finally tried to just reboot the machine, and that worked. I guess the /etc/init.d/ssh restart wasn't working for some reason? Anyway, I hope this helps someone.

  • 1
    For me I didn't change anything as the configuration was set like that from the beginning on digitalocean. however restarting sshd via sudo systemctl restart sshd worked. Seems like a bug in digitalocean's droplet initialization but whatever
    – aaaaaa
    Sep 14, 2019 at 18:35

This additional line works for me in /etc/ssh/sshd_config.

AuthenticationMethods publickey

Try setting PreferredAuthentications to just publickey.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.