Disabling password authentication for SSH doesn't work as expected Ubuntu 14.04 LTS

Question

I want to make sure that the only way to access a computer through SSH is if the client's key is already added to the authorized_keys file on the server.

For this, I edit /etc/ssh/sshd_config and enable the following options

ChallengeResponseAuthentication no
PasswordAuthentication no
PubkeyAuthentication yes
UsePAM no

Following this, I restart the sshd service

sudo /etc/init.d/ssh restart

However, when I try to ssh into the server from a client whose key is not saved in the server's authorized keys file, I get prompted for a password.

EDIT: I have figured out what the problem is, but I am going to leave this question here in case it is useful to someone else.

What happens is that when connecting from a client with a key not in the authorized_keys file, the server asks for the password, but no matter what password is entered, it is declined. I think this is so that it is difficult for attackers to understand how the sshd is configured.

Tower

I have noticed in some 14.04 that instead of using init.d to restart try using sudo service ssh restart. – Hind

Belongs ons Server Fault SE. – Hamforrd

@ADRENALIN: "Same here, this is first time I have this problem." What problem? OP explains in his edit that password authentication with an unauthorized client key will fail. "All previous Ubuntu versions were fine." Please define 'fine'; maybe original behaviour is considered unsafe by today's standards, again as explained in OP's edit. – Aventurine

@CCG: Please create an answer to your own question, to get this question out of the list of unanswered questions. If you hurry up, you might even claim that bounty! ;) – Aventurine

Answer 1

The behavior that I described above is the intended behavior of the sshd. No matter what password is entered, it will not be accepted.

Tower

Answer 2

I was on ubuntu 20.04 and found out that sshd_config had a file included on the very beginning "Include /etc/ssh/sshd_config.d/*.conf" which had "PasswordAuthentication yes" in it that overrides that setting in sshd_config

Pyridoxine

Can confirm that /etc/ssh/sshd_config.d/50-cloud-init.conf still exists in Ubuntu 22.04 – Hassett

... and that's why since Ubuntu 20.04 one should never directly edit /etc/ssh/sshd_config, but instead create a drop-in *.conf file in /etc/ssh/sshd_config.d/ with your overrides. Make sure you name it 00-something.conf or similar so it is picked up before the 50-cloud-init.conf, as per SSH rules the first setting wins – Shadrach

God, this took me way too long. Super obvious in hindsight. – Pollster

Answer 3

Just to help anyone who finds this and still seems to be able to login with root and password, I found that rebooting the VPS seemed to get everything reconfigured properly.

Purgative