---
title: "Allow SSH with keys only · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/servers/ssh-keys-only
updated: 2026-10-20
licence: "All rights reserved"
---

# Allow SSH with keys only

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Servers](https://agentwranglers.se/playbook/infrastructure/servers)
- Rule: Turn off password logins and direct root logins over SSH. Give each person their own key, and remove it the day they leave.
- How: Put the settings in a file under `/etc/ssh/sshd_config.d/` whose name sorts first, such as `10-hardening.conf`. For most keywords the first value sshd reads wins. Cloud images often ship a later file, such as `50-cloud-init.conf`, that turns passwords back on. Check that the main file's `Include` line comes before its own settings. Prefer short-lived SSH certificates from your identity provider over keys that never expire. Better still, use a tunnel that needs single sign-on, as in [close admin ports](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/no-public-admin-ports).
- Check: `sshd -T` prints `passwordauthentication no`, `kbdinteractiveauthentication no` and `permitrootlogin no`. A login that offers only a password is refused. Run `sshd -t` before every reload, so a broken file never locks you out.

Example:

```text
# /etc/ssh/sshd_config.d/10-hardening.conf
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
AuthenticationMethods publickey
```

```sh
sshd -T | grep -E '^(passwordauthentication|kbdinteractiveauthentication|permitrootlogin) '
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no admin@shop.example.com   # Permission denied
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/servers/ssh-keys-only`.

- Previous: [Turn on a firewall on every host](https://agentwranglers.se/playbook/infrastructure/servers/host-firewall)
- [Servers](https://agentwranglers.se/playbook/infrastructure/servers)