1.3. Setting key-based authentication as the only method on an OpenSSH server

To improve system security, enforce key-based authentication by disabling password authentication on your OpenSSH server.

Prerequisites

The openssh-server package is installed.
The sshd daemon is running on the server.
You can already connect to the OpenSSH server by using a key.
See the Generating SSH key pairs section for details.

Procedure

Open the /etc/ssh/sshd_config configuration in a text editor, for example:
```
# vi /etc/ssh/sshd_config
```
Change the PasswordAuthentication option to no:
```
PasswordAuthentication no
```
On a system other than a new default installation, check that the PubkeyAuthentication parameter is either not set or set to yes.
Set the KbdInteractiveAuthentication directive to no.
Note that the corresponding entry is commented out in the configuration file and the default value is yes.
To use key-based authentication with NFS-mounted home directories, enable the use_nfs_home_dirs SELinux boolean:
```
# setsebool -P use_nfs_home_dirs 1
```
If you are connected remotely, not using console or out-of-band access, test the key-based login process before disabling password authentication.
Reload the sshd daemon to apply the changes:
```
# systemctl reload sshd
```