I configured Ubuntu 24.04's sshd_config with PasswordAuthentication no, PermitRootLogin no, and PubkeyAuthentication yes. I restarted the SSH service with sudo systemctl restart ssh, but I can still connect to the VirtualBox VM using a password. The same behavior occurs with a Hyper-V VM, so it doesn't appear to be specific to VirtualBox. Has something changed in newer Ubuntu releases, or is another SSH setting overriding my configuration?
2 Answers
VirtualBox and Hyper-V aren’t involved in SSH authentication here. On newer Ubuntu systems, keyboard-interactive authentication can still accept a password even when PasswordAuthentication is set to no. Try explicitly setting KbdInteractiveAuthentication no as well. Also inspect /etc/ssh/sshd_config.d/ for drop-in files that may override or supplement the main configuration. You can verify the effective settings with sudo sshd -T, then restart the service after making changes.
The setting you changed only disables the password authentication method itself; it doesn’t necessarily disable every authentication method that can prompt for a password. Check the complete effective sshd configuration rather than relying only on sshd_config, especially the files under /etc/ssh/sshd_config.d/. Also make sure you’re testing a normal user account and not accidentally connecting through another service or configuration.
The SSH service was already restarted, so I’ll focus on checking the effective configuration and the additional files included by the newer Ubuntu setup.
I’ll check KbdInteractiveAuthentication and the drop-in configuration files. I hadn’t needed to account for that on older Ubuntu installations, so this explains why the behavior seems different.