Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
I'd like to disable password authentication for SSH (for all the users) in Linux. I'm setting the PasswordAuthentication to no is the sshd_config file but then I'm no longer to log in using my private key.
p.s. I'm specifying my private key file when trying to log in.
Before you disable password authentication you need to configure public key authentication and ensure that you are using it. If you haven't already done so, you can generate a key pair using ssh-keygen.
The key pair consists of a private key and a public key with .pub at the end of the file name. The public key consists of a single line with a type, the public key, and a comment. I find it useful to edit the comment to include the date on which the key pair was generated, as that is not included in the default comment.
You need to put that one line in .ssh/authorized_keys on the account you log in on.
When you connect to the server using ssh in the future you will not be asked for a password to log in. You may be asked for a passphrase for the key if you entered one when creating it. If you don't want to be asked for the passphrase each time you log in use ssh-agent.
On the server you can edit /etc/ssh/sshd_config find the PasswordAuthentication line and make it:
PasswordAuthentication no
If there is no PasswordAuthentication line in the file you need to add one. There may be a comment telling you what the default value is. You can either remove the # on that line to make it no longer be a comment or add a PasswordAuthentication line after the comment.
To make the change take effect run
service ssh reload
as root on the server. This command is on Ubuntu it may differ slightly between distributions. I recommend running the command in a screen session such that the reload will complete even if you lose connectivity to the server when running it.
Once you have made the change open a new window to start another ssh connection to verify that connectivity works as intended. This step is important as the shell you left open gives you a last chance to fix the problem if you accidentally locked yourself out from reaching a root shell on the server.
On the server disable SSH password authentication, also disable being able to login as root.
Note Make sure you have a user on the server with a password before doing this or you will be locked out from the server.
$ vim /etc/ssh/sshd_config
Edit / add the following lines
Execute the command
$ service ssh restart
Create a new SSH key on client (example)
cd ~/.ssh
ssh-keygen -t rsa -b 4096 -C server1 -f server1
Copy the SSH key to the server
ssh-copy-id -i server1.pub username@server-ip
Use the new key to connect to the server
vim ~/.ssh/config
Add the following lines
Host ip-of-server
User yourUsername
IdentifyFile /home/yourUsername/.ssh/server1
Connect to the server
ssh server-ip
Check the file and folder permission on the server where you want to login to. If the permission is too loose it doesn't work.
chmod 700 ~/.ssh
chmod 600 ~/.ssh/
sshd_configfile in your question. – Gerald Schneider Apr 28 '18 at 17:45