Before you disable password authentication you need to configure public key authentication and ensure that you are using it. If you haven't already done so, you can generate a key pair using ssh-keygen
.
The key pair consists of a private key and a public key with .pub
at the end of the file name. The public key consists of a single line with a type, the public key, and a comment. I find it useful to edit the comment to include the date on which the key pair was generated, as that is not included in the default comment.
You need to put that one line in .ssh/authorized_keys
on the account you log in on.
When you connect to the server using ssh in the future you will not be asked for a password to log in. You may be asked for a passphrase for the key if you entered one when creating it. If you don't want to be asked for the passphrase each time you log in use ssh-agent
.
On the server you can edit /etc/ssh/sshd_config
find the PasswordAuthentication
line and make it:
PasswordAuthentication no
If there is no PasswordAuthentication
line in the file you need to add one. There may be a comment telling you what the default value is. You can either remove the #
on that line to make it no longer be a comment or add a PasswordAuthentication
line after the comment.
To make the change take effect run
service ssh reload
as root on the server. This command is on Ubuntu it may differ slightly between distributions. I recommend running the command in a screen
session such that the reload
will complete even if you lose connectivity to the server when running it.
Once you have made the change open a new window to start another ssh connection to verify that connectivity works as intended. This step is important as the shell you left open gives you a last chance to fix the problem if you accidentally locked yourself out from reaching a root shell on the server.
sshd_config
file in your question. – Gerald Schneider Apr 28 '18 at 17:45