TL;DR: How to set up SSH key login and turn off password login

KB ID 2610140007

Problem: You want to log in to a Linux server over SSH with a key instead of a password, and then stop the server accepting passwords at all.
Applies to: OpenSSH server and client (sshd, ssh, ssh-keygen, ssh-copy-id, ssh-agent, ssh-add), OpenSSH 8.7 or later for the KbdInteractiveAuthentication name; the Windows OpenSSH client
Time to fix: 20 to 30 minutes, including the tests

Symptoms, platforms, difficulty and more

Symptoms: You do this when a server is reachable from the internet or a shared network and is being hit by password guessing (many "Failed password" lines in the auth log), when an audit asks for key-only SSH, or when you are tired of typing passwords. Afterwards, a connection without the key ends with "Permission denied (publickey)." and never asks for a password.
Platforms affected: Server: Linux with OpenSSH (sshd). Clients: Linux, macOS, Windows 10 and 11 (built-in OpenSSH client)
Difficulty: Intermediate (root access on the server, editing a service configuration; a mistake can lock you out)
Verified on: Key generation, key login, the permission check, the config validation and the "password refused" result were tested on Arch Linux with OpenSSH 10.5p1, 14 October 2026, using a throwaway sshd on 127.0.0.1 port 2299 with a temporary config, host key and authorized_keys in a temporary directory (nothing under ~/.ssh, no /etc changes, no root, no remote hosts). Tested: ssh-keygen -t ed25519 with a passphrase, login with the passphrase-protected key, sshd -t on a valid file (silent, exit 0) and on a file with a misspelt option (error, exit 255), PasswordAuthentication no plus KbdInteractiveAuthentication no giving "Permission denied (publickey)." for a password-only attempt, a group- or world-writable authorized_keys being refused ("Authentication refused: bad ownership or modes for file"), and the first-value-wins rule with an Include of a drop-in directory. Not tested by KEH-TECH: a Windows or macOS client, the Windows ssh-agent service, ssh-copy-id against a real password login, cloud-init or other distribution drop-ins (50-cloud-init.conf and similar), Debian, Ubuntu, RHEL or SUSE service names and socket activation, SELinux, a group-writable home directory, and loading a key into ssh-agent and logging in through it. Those parts come from the OpenSSH manual pages, the OpenSSH release notes and Microsoft Learn.
Category: How-to
Updated: 14 Oct 2026
Tags: Hardening, Linux, OpenSSH, Security, SSH

The fix only. No explanation, no diagnosis. Read the full article if any of this does not match what you are seeing.

On your own machine, make a key with a passphrase: ssh-keygen -t ed25519 -C "you@yourpc"
Install the public key on the server (Linux, macOS), then log in with it from a NEW terminal:

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server
ssh -o PreferredAuthentications=publickey user@server

On the server, create /etc/ssh/sshd_config.d/00-keys-only.conf containing PasswordAuthentication no, KbdInteractiveAuthentication no and PermitRootLogin no.
Validate, check the effective values, then reload (ssh on Debian/Ubuntu, sshd on RHEL/Fedora/Arch):

sudo sshd -t
sudo sshd -T | grep -Ei '^(passwordauth|kbdinteractive|permitroot)'
sudo systemctl reload ssh

From a third terminal, confirm the key still works and a password is refused.

Keep your first working session open until step 5 passes. If it fails, fix it from that session. Know where the server console is before you start.

← Full article, with the diagnosis and the why

Was this helpful?

Updated on October 14, 2026