When I login via ssh with
-v I see that ssh is authenticating the following way
debug1: Authentications that can continue: publickey,gssapi-with-mic,password,hostbased
I would like to change the order ...any idea how?
My bigger problem is that user with locked accounts, can still login via public-keys. I have found that I could add the user to a group "ssh-locked" add deny that group from sshing, but I am still wondering if there is a way to tell ssh'd: Please check password before keys...