user-documentation/modules/ROOT/partials/installation/post-install/disable-password-login.adoc

// Text excerpt about system-wide disabling password login
// consumer postinstallation-tasks.adoc (main), hetzner-dc.adoc
a. On the server, create a configuration file and edit
+
[source,]
----
[…]# vi /etc/ssh/sshd_config.d/60-local.conf

# Local customization: disable password login except for
# one (optionally add some more) user as a fallback option.
PasswordAuthentication no

Match User hostmin 
    PasswordAuthentication yes 
#Match User hostmin2 
#    PasswordAuthentication yes
----
b. Reload the sshd daemon 
+
[source,]
----
[…]# systemctl reload sshd
----

c. Test that everything works as expected
+
* Is an authorized user able to log in?
* Are other users rejected with the message "Permission denied (publickey,gssapi-keyex,gssapi-with-mic)"?
* If this does not work and/or other users are able to log in with a password besides your known authorized user,
** install the latest updates. 
** check the file _/etc/ssh/sshd_config.d/50-redhat.conf_ to make sure that it does not include the line "PasswordAuthentication yes" (as this is already the default and should not be repeated or else it could hinder other configurations).