如何强制SSH仅允许具有密钥的用户登录？
我尝试按照这里的说明操作： http ： //lani78.wordpress.com/2008/08/08/generate-a-ssh-key-and-disable-password-authentication-on-ubuntu-server/
只允许在服务器上使用公钥的用户进行身份validation，但我无法通过SSH禁止只使用用户名/密码登录。
这是我的sshd_config文件 – 我错过了什么吗？ 我已经尝试重启SSH和计算机本身。
# Package generated configuration file # See the sshd_config(5) manpage for details # What ports, IPs and protocols we listen for Port 22 # Use these options to restrict which interfaces/protocols sshd will bind to #ListenAddress :: #ListenAddress 0.0.0.0 Protocol 2 # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key HostKey /etc/ssh/ssh_host_ecdsa_key #Privilege Separation is turned on for security UsePrivilegeSeparation yes # Lifetime and size of ephemeral version 1 server key KeyRegenerationInterval 3600 ServerKeyBits 768 # Logging SyslogFacility AUTH LogLevel INFO # Authentication: LoginGraceTime 120 PermitRootLogin yes StrictModes yes RSAAuthentication yes PubkeyAuthentication yes #AuthorizedKeysFile %h/.ssh/authorized_keys # Don't read the user's ~/.rhosts and ~/.shosts files IgnoreRhosts yes # For this to work you will also need host keys in /etc/ssh_known_hosts RhostsRSAAuthentication no # similar for protocol version 2 HostbasedAuthentication no # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication #IgnoreUserKnownHosts yes # To enable empty passwords, change to yes (NOT RECOMMENDED) PermitEmptyPasswords no # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) ChallengeResponseAuthentication no # Change to no to disable tunnelled clear text passwords #PasswordAuthentication no # Kerberos options #KerberosAuthentication no #KerberosGetAFSToken no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes #UseLogin no #MaxStartups 10:30:60 #Banner /etc/issue.net # Allow client to pass locale environment variables AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. UsePAM no 默认情况下，即使您将其注释掉， PasswordAuthentication也会设置为yes。 在/etc/ssh/sshd_config就是这种情况。
您需要显式设置PasswordAuthentication no以仅允许公钥身份validation。
# Change to no to disable tunnelled clear text passwords PasswordAuthentication no
并重新启动sshd service ssh restart （pre systemd migration）或systemctl restart sshd.service 。
根据这个关于SSH密钥的wiki页面和这个答案 ，你需要在sshd_config更改这两行：
PasswordAuthentication no ChallengeResponseAuthentication no
在/etc/ssh/sshd_config ，下面的设置对我/etc/ssh/sshd_config ：
PasswordAuthentication no UsePAM no
最后，重启sshd守护进程。
默认情况下，在sshd_config文件中，您想要的行被exception注释掉。
# Change to no to disable tunnelled clear text passwords --->#PasswordAuthentication yes
要禁用密码，请将yes更改为no并删除注释 ：
# Change to no to disable tunnelled clear text passwords PasswordAuthentication no
来自https://www.ssh.com/ssh/copy-id#sec-How-ssh-copy-id-works ：通常，用户的主目录或任何包含密钥文件的文件或目录不应由其他任何人写入。 否则，其他人可以为用户添加新的授权密钥并获得访问权限。 私人密钥文件不应该被其他任何人读取。
尝试使用sudo chmod go-rwx /home/username/替换username 。