Harden sshd: Disable Password Authentication

Password authentication is the surface that brute-force bots hammer all day. Once your key is installed and you have confirmed it works, turn passwords off. The whole attack class disappears.

The settings that matter

Edit /etc/ssh/sshd_config (or, better, a drop-in like /etc/ssh/sshd_config.d/99-hardening.conf on modern distros):

# Keys only, no passwords
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

# No direct root login
PermitRootLogin no

KbdInteractiveAuthentication no matters: on some systems a password can still be entered through the keyboard-interactive path even after PasswordAuthentication no, so disable both. PermitRootLogin no forces everyone in through a normal account plus sudo.

Apply it without locking yourself out

This is the part people get wrong. Before you cut over, prove key auth works, and keep a second session open.

# 1. In a SECOND terminal, confirm you can log in with your key right now.
ssh user@server

# 2. Check the config for syntax errors before restarting.
sudo sshd -t

# 3. Reload (does not drop existing sessions).
sudo systemctl reload ssh   # or: sudo systemctl reload sshd

Keep your existing session open until a brand-new connection succeeds. If something is wrong, you still have the open session to fix it. sshd -t catches typos before they take the service down.

Worth adding while you are here

# Don't wait forever on a half-open login
LoginGraceTime 20

# Optional: restrict who can log in at all
AllowUsers deploy ishan

Resist the urge to change the port for "security." Moving off 22 cuts log noise but is not a real control; keys-only plus no-root is what actually matters. If you want fewer logs, a tool like fail2ban is more honest than security-through-obscurity.

FAQ

See also

• Add an SSH key to a server: do this first, and verify it, before turning passwords off.
• How to disable root login: the console and password side of locking down root.
• How to give a user sudo access: the normal-account-plus-sudo pattern that replaces root login.
• SSH Cheat Sheet: the rest of the SSH surface.