Allow SSH with keys only

How to do it

Put the settings in a file under /etc/ssh/sshd_config.d/ whose name sorts first, such as 10-hardening.conf. For most keywords the first value sshd reads wins. Cloud images often ship a later file, such as 50-cloud-init.conf, that turns passwords back on. Check that the main file's Include line comes before its own settings. Prefer short-lived SSH certificates from your identity provider over keys that never expire. Better still, use a tunnel that needs single sign-on, as in close admin ports.

Example

# /etc/ssh/sshd_config.d/10-hardening.conf
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
AuthenticationMethods publickey

sshd -T | grep -E '^(passwordauthentication|kbdinteractiveauthentication|permitrootlogin) '
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no admin@shop.example.com   # Permission denied

How to check

sshd -T prints passwordauthentication no, kbdinteractiveauthentication no and permitrootlogin no. A login that offers only a password is refused. Run sshd -t before every reload, so a broken file never locks you out.