SSH disable password login for root (only allow public key authentication)

SSH (Secure SHell) is a system that allows remote login to Linux/*BSD servers or VPS servers securely, traffic between ssh client and server being encrypted as well as the username and password used to login.
In certain scenarios, root password login only or global password login should be restricted to increase the security level of the intended VPS server. This is done in tandem with SSH Key authentication (see https://vpsie.com/ssh-key-authentication-linux-vps-server/) to avoid loosing access.

In order for root user to be able to login, first of all make sure it's listed in AllowedUsers if this directive is being used in ssh server configuration file /etc/ssh/sshd_config.

SSH:Disable password login for root user only

Second, change PermitRootLogin from yes/no to "without-password":

Code:

#PermitRootLogin yes
PermitRootLogin without-password

Quote:

PermitRootLogin
Specifies whether root can log in using ssh(1). The argument
must be ``yes'', ``without-password'', ``forced-commands-only'',
or ``no''. The default is ``no''. Note that if
ChallengeResponseAuthentication is ``yes'', the root user may be
allowed in with its password even if PermitRootLogin is set to
``without-password''.

If this option is set to ``without-password'', password authenti-
cation is disabled for root.

If this option is set to ``forced-commands-only'', root login
with public key authentication will be allowed, but only if the
command option has been specified (which may be useful for taking
remote backups even if root login is normally not allowed). All
other authentication methods are disabled for root.

If this option is set to ``no'', root is not allowed to log in.

Disable password authentication for all users in SSH

Another option is to disable password authentication for ssh globally, for all users.

Code:

...
PasswordAuthentication no
...

Quote:

PasswordAuthentication
Specifies whether password authentication is allowed. The default is “yes”.

Restart ssh daemon and try again (Leave one terminal up as backup).

Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

FreeBSD tutorials and how-tos