How to Completely Disable ‘SSH Password Authentication’ (Force SSH Keys) in Ubuntu Server

By default, when you install Ubuntu Server and enable the OpenSSH daemon, it permits users to log in using a standard username and password combination. While this makes initial setup easy, it is a catastrophic security vulnerability for any server exposed to the public internet.

Within minutes of bringing an Ubuntu server online, automated botnets will discover its IP address and begin launching relentless “brute-force” dictionary attacks against port 22, guessing thousands of common passwords every minute in an attempt to breach the root or ubuntu accounts. If your password is weak, or if a user reuses a password compromised in a previous data breach, the server will inevitably fall. To guarantee absolute cryptographic security and render brute-force attacks mathematically impossible, you must completely disable SSH password authentication and force all users to authenticate using cryptographic SSH keys.

Prerequisite: Ensure Your SSH Keys Are Working

Extreme Warning: Do not proceed with these steps until you have successfully generated an SSH key pair (e.g., using ssh-keygen -t ed25519) and successfully copied the public key to your server’s ~/.ssh/authorized_keys file. If you disable passwords before your keys are working, you will be permanently locked out of your own server.

Disabling Password Authentication via sshd_config

The authentication rules are governed by the main OpenSSH daemon configuration file.

1. Open a Terminal session and log into your server using your verified SSH key.
2. Open the SSH daemon configuration file in a text editor with root privileges:
   sudo nano /etc/ssh/sshd_config
3. Carefully scroll through the file until you locate the line that says:
   #PasswordAuthentication yes (or it may not have a hash symbol).
4. You must explicitly uncomment this line (remove the #) and change the “yes” to a “no”. The line must look exactly like this:
   PasswordAuthentication no
5. (Optional but highly recommended): Scroll further down and locate the PermitRootLogin directive. Ensure it is set to either prohibit-password or no.
6. Save the file (Ctrl + O, then Enter) and exit the text editor (Ctrl + X).

Restarting the SSH Daemon

For the new security posture to take effect, you must restart the SSH service. Do not close your current terminal window during this process (if you made a syntax error, your active connection will remain alive so you can fix it).

1. Restart the SSH daemon:
   sudo systemctl restart sshd
2. Open a brand new, secondary terminal window on your local machine and attempt to log in to the server without specifying your SSH key.
3. The server should instantly reject the connection, displaying an error message stating: Permission denied (publickey).

Your Ubuntu server is now immune to password brute-forcing. The automated botnets will continue to scan your port, but without a cryptographic private key, their login attempts will instantly fail at the protocol level.