How to turn off SSH password authentication — keys only

Passwords are the attack surface; keys should be the only way in.

Every flag and config keyword was checked against the OpenSSH 9.6 man pages, and the config examples were parsed for real with ssh -G.

PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no

Good to know

Verify key-based login works in a NEW session first — with passwords off, a lost key means only console access gets you back in. The third line matters: on PAM-based systems the password prompt can survive through keyboard-interactive even with PasswordAuthentication no.

SSH Cheatsheet one-page card — commands that actually work — The full one-page card — SSH Cheatsheet. Get the complete cheatsheet on GitHub