How to enable SSH password authentication in Linux

Run this on the server:

echo 'PasswordAuthentication yes' | sudo tee /etc/ssh/sshd_config.d/00-password.conf
sudo sshd -T | grep -i passwordauthentication
sudo systemctl restart ssh

The second command must print passwordauthentication yes. On Ubuntu 24.04 it may print Missing privilege separation directory: /run/sshd instead: run sudo systemctl start ssh and repeat. On Fedora, RHEL and AlmaLinux the service is sshd: sudo systemctl restart sshd. Then log in from your computer:

ssh alice@server

Keep your current session open until the password login works: if the new config is broken, it's your way back in.

Tested on Ubuntu 24.04 and 26.04, Debian 12 and 13, with password logins from another host.

Why PasswordAuthentication yes in sshd_config does nothing

Editing /etc/ssh/sshd_config, as this post advised in 2017, often does nothing on a cloud server. Near the top of that file Ubuntu, Debian, Fedora and RHEL 9+ have:

Include /etc/ssh/sshd_config.d/*.conf

RHEL 8 and CentOS 7 have neither the line nor sshd_config.d: the first command at the top fails with No such file or directory. Set PasswordAuthentication yes in /etc/ssh/sshd_config itself.

sshd keeps the first value it reads for each option (sshd_config(5)). Drop-in files come first, in alphabetical order, so any of them can say no and beat the main file. On cloud images it's usually 50-cloud-init.conf, written by cloud-init from its ssh_pwauth setting. 00-password.conf sorts before it.

To find who sets the option:

sudo sh -c 'grep -i passwordauthentication /etc/ssh/sshd_config.d/*.conf /etc/ssh/sshd_config'

The first line without # wins, and you can change its no to yes right there. sshd reads only *.conf files: 00-password without the extension is ignored.

Without sh -c, your own shell expands *.conf before sudo runs. On Fedora and RHEL 9+ only root can read sshd_config.d, so grep prints No such file or directory and shows only the main file.

sshd -T shows the new value before the restart; the running sshd keeps the old one until then.

How to connect to SSH with a password

On your computer:

ssh alice@server

alice is your user on the server, server is its IP address or domain name. On the first connection ssh shows the server's key fingerprint: type yes. Then it asks for the password and shows nothing as you type.

If you have SSH keys, ssh tries them first. To go straight to the password:

ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no alice@server

Restart SSH on Ubuntu 24.04: ssh, not sshd

Since 22.10 Ubuntu starts sshd through socket activation: systemd listens on port 22 (ssh.socket) and starts ssh.service on the first connection. On 24.04 that means:

• sudo systemctl restart sshd fails: Unit sshd.service not found. On Ubuntu 26.04 and Debian both names work.
• sudo systemctl reload ssh fails with ssh.service is not active, cannot reload if nobody has connected since boot. restart works either way.
• sudo sshd -t and sudo sshd -T say Missing privilege separation directory: /run/sshd for the same reason: systemd creates that directory when ssh.service starts and deletes it when the service stops. Run sudo systemctl start ssh and repeat.

A new Port or ListenAddress also needs sudo systemctl daemon-reload and sudo systemctl restart ssh.socket, per the package's README.Debian.

Run sudo sshd -t before restarting: silence means the config is valid, otherwise it names the file and line. With a typo the restart fails and new connections are refused, but open sessions survive.

Allow root login with a password

For root, PasswordAuthentication yes isn't enough. The default, PermitRootLogin prohibit-password, lets root in only with a key: the right password gets Permission denied, please try again. sshd -T may show it under the old name without-password. To allow it:

echo 'PasswordAuthentication yes' | sudo tee /etc/ssh/sshd_config.d/00-password.conf
echo 'PermitRootLogin yes' | sudo tee /etc/ssh/sshd_config.d/00-root.conf
sudo passwd root
sudo systemctl restart ssh

The first command is the one from the top of this post. Without it the no in 50-cloud-init.conf still wins, and root gets Permission denied (publickey).

Ubuntu locks the root password at install, hence passwd. A regular user with sudo is safer: how to create an admin user.

Password login for one user or one network

To allow passwords only for one account or your home network, add this to the end of /etc/ssh/sshd_config:

Match User alice
    PasswordAuthentication yes

Match Address 192.168.1.0/24
    PasswordAuthentication yes

A Match block lasts until the next Match or the end of the file, and its values beat the global ones, including the no in 50-cloud-init.conf. Check a specific connection:

sudo sshd -T -C user=alice,host=laptop,addr=203.0.113.5 | grep -i passwordauthentication

The password is right, but login fails

• The account has no password. Cloud-init creates the default user, like ubuntu, with password login locked. Set one: sudo passwd ubuntu.
• Too many authentication failures. ssh-agent offers every key first, and after six failures the server hangs up. Skip the keys with -o PubkeyAuthentication=no, as in "How to connect to SSH with a password" above.
• Permission denied (publickey) with no prompt. Passwords are off: check sshd -T. ssh -o BatchMode=yes alice@server shows the offered methods; (publickey,password) means passwords are on.

Do I need KbdInteractiveAuthentication?

Not for a password prompt: PasswordAuthentication yes is enough, and Ubuntu and Debian ship KbdInteractiveAuthentication no. It matters when you turn passwords off. With UsePAM yes, as Ubuntu and Debian ship it, KbdInteractiveAuthentication yes still asks for the password through PAM, so set both to no. Older configs, like 50-redhat.conf on AlmaLinux, use its old name, ChallengeResponseAuthentication.

Can I put the password in ~/.ssh/config?

No: the client has no such option, and Password gets Bad configuration option: password. Copy a key while password login is on:

ssh-copy-id alice@server

If you don't have a key yet, ssh-keygen -t ed25519 creates one (more on SSH keys on a Mac). In a script that can't use a key, sshpass -e reads the password from SSHPASS:

SSHPASS="$SERVER_PASSWORD" sshpass -e ssh -o StrictHostKeyChecking=accept-new alice@server

accept-new saves the key of a server ssh hasn't seen. Without it the first connection stops at the host key question, and sshpass silently exits with code 6.

Protect password login with fail2ban

Passwords can be guessed. Use a long one and fail2ban:

sudo apt install fail2ban
sudo fail2ban-client status sshd

On Ubuntu 24.04, 26.04 and Debian 13 the sshd jail works out of the box: five failed logins in 10 minutes ban the IP for 10 minutes. On Debian 12 fail2ban won't start (Have not found any log file for sshd jail): Debian 12 doesn't install rsyslog, so there's no /var/log/auth.log. Point it at the journal and nftables, as Debian 13 does:

printf '[DEFAULT]\nbanaction = nftables\nbanaction_allports = nftables[type=allports]\nbackend = systemd\n' | sudo tee /etc/fail2ban/jail.local
sudo systemctl restart fail2ban

Once your key is on the server, turn passwords off: PasswordAuthentication no and KbdInteractiveAuthentication no in 00-password.conf, then restart ssh.