Guide CyberPanel SSH Key Login and Disabling Password Login (the Ubuntu cloud-init Trap)

Guide CyberPanel SSH Key Login and Disabling Password Login (the Ubuntu cloud-init Trap) - Printable Version

+- AdminsForum (https://adminsforum.com)
+-- Forum: Free & open-source control panels (https://adminsforum.com/Forum-free-open-source-control-panels)
+--- Forum: CyberPanel (https://adminsforum.com/Forum-cyberpanel)
+---- Forum: CyberPanel Guides & Tutorials (https://adminsforum.com/Forum-cyberpanel-guides-tutorials)
+----- Forum: CyberPanel Security Guides (https://adminsforum.com/Forum-cyberpanel-security-guides)
+----- Thread: Guide CyberPanel SSH Key Login and Disabling Password Login (the Ubuntu cloud-init Trap) (/Thread-guide-cyberpanel-ssh-key-login-and-disabling-password-login-the-ubuntu-cloud-init-trap)

CyberPanel SSH Key Login and Disabling Password Login (the Ubuntu cloud-init Trap) - JAY - 10-26-2026

CyberPanel SSH Key Login and Disabling Password Login (the Ubuntu cloud-init Trap)

Every server on the internet gets password guesses on SSH within minutes. Logging in with an SSH key instead of a password and then switching passwords off stops all of that cold. CyberPanel has a page for SSH keys, but turning password login off is where most people go wrong on Ubuntu: we did it the "obvious" way and password login stayed on. Here's the full, tested way, and how to check that it really worked.

Before you start

Keep your current SSH session open the whole time. Test every change in a second terminal.
Make sure you have your VPS provider's console (VNC) as a way in if SSH breaks.

Step 1: What does your server allow right now?
This is what our server had, checked with

Code:

sshd -T

(the settings sshd really uses):
[Image: attachment.php?aid=573]

Code:

sshd -T | grep -Ei '^(port|passwordauthentication|permitrootlogin|pubkeyauthentication) '

Port 22, root login allowed, and both keys and passwords allowed. There was no

Code:

/root/.ssh/authorized_keys

yet, and one extra config file:

Code:

/etc/ssh/sshd_config.d/50-cloud-init.conf

. Remember that file, it matters in Step 4.

Step 2: Create a key on your own computer
On Linux, macOS and Windows 10/11 (PowerShell has OpenSSH built in) it's the same command:

Code:

ssh-keygen -t ed25519 -C "my-laptop"

Press Enter for the default location and set a passphrase if you like. You get two files:

Code:

id_ed25519

(private, never leaves your computer) and

Code:

id_ed25519.pub

(public, this goes on the server). Show the public one:

Code:

cat ~/.ssh/id_ed25519.pub

It's one line starting with

Code:

ssh-ed25519

.

Step 3: Add the public key in CyberPanel
Security > Secure SSH (

Code:

https://YOUR-SERVER-IP:8090/firewall/secureSSH

), tab SSH Keys, Add Key.
Paste it and click Save Key:
[Image: attachment.php?aid=574]

Two things we noticed:

The key is added for root: CyberPanel writes it to
Code:
/root/.ssh/authorized_keys
, with a
Code:
#Created by CyberPanel
comment on top. There is no way to pick another Linux user on this page.
The User Name column just shows the comment at the end of your key (
Code:
panel-test-key
in our test), not a user. Give your keys clear comments (laptop, office PC) so you know which one to delete later.

Without the panel it's one command from your computer:

Code:

ssh-copy-id -i ~/.ssh/id_ed25519.pub root@YOUR-SERVER-IP

.

Now test it from a new terminal on your computer:

Code:

ssh -i ~/.ssh/id_ed25519 root@YOUR-SERVER-IP

It must log you in without asking for the server password (it may ask for the key's passphrase). In our test the key login worked straight away. Don't continue until this works.

Step 4: Turn off password login (and the trap)
The CyberPanel page only has SSH Port and Permit Root Login; there's no switch for passwords. So it's a config file. On Ubuntu the clean way is a small file in

Code:

/etc/ssh/sshd_config.d/

instead of editing the main config.
We put

Code:

PasswordAuthentication no

into

Code:

/etc/ssh/sshd_config.d/99-hardening.conf

, reloaded SSH and checked:
[Image: attachment.php?aid=575]

Code:

passwordauthentication yes

, and a login attempt without a key was still offered

Code:

(publickey,password)

. Nothing changed.

The reason: for each setting, sshd uses the first value it reads, and it reads the files in

Code:

sshd_config.d

in alphabetical order. Ubuntu's cloud images ship

Code:

50-cloud-init.conf

with

Code:

PasswordAuthentication yes

. That file comes before

Code:

99-...

, so it wins. Most VPS providers use these images, so you probably have the same file.

The fix is a name that sorts before 50:

Code:

echo 'PasswordAuthentication no' > /etc/ssh/sshd_config.d/00-hardening.conf
rm -f /etc/ssh/sshd_config.d/99-hardening.conf
sshd -t && systemctl reload ssh
sshd -T | grep -i '^passwordauthentication'

(You could also change the line inside

Code:

50-cloud-init.conf

, but cloud-init may write that file again.)
We renamed our file so it's read first, and tested both ways of logging in:
[Image: attachment.php?aid=576]

Code:
sshd -T
now says
Code:
passwordauthentication no
.
Without a key:
Code:
Permission denied (publickey)
. Password isn't even offered any more.
With the key: logged in.

Code:

sshd -t

checks the config for errors before the reload. If it prints anything, fix that first. A reload doesn't drop your open session.

Step 5 (optional): Root login and the port

Permit Root Login on the same CyberPanel page: only switch it off after you created another user with sudo rights and tested that you can log in with it (add your key to that user's
Code:
~/.ssh/authorized_keys
by hand, the panel only does root). A softer option is
Code:
PermitRootLogin prohibit-password
in your
Code:
00-hardening.conf
: root can still log in, but only with a key.
SSH Port: a different port cuts the log noise but isn't real security. If you change it, open the new port in the firewall before you save, as shown in the CyberPanel firewall guide.

We didn't change root login or the port on our test server.

If you lock yourself out
Log in through your provider's VNC/console (it uses the local login, not SSH) and remove the file:

Code:

rm /etc/ssh/sshd_config.d/00-hardening.conf
systemctl reload ssh

Password login is back. That's exactly how we undid our test afterwards.

Checklist

Key works in a new terminal before you turn passwords off.
Your setting is in a file that sorts before
Code:
50-cloud-init.conf
.
Code:
sshd -T
shows
Code:
passwordauthentication no
, not just your file.
A login without a key says
Code:
Permission denied (publickey)
.
Keep a copy of your private key somewhere safe (password manager). If you lose it, only the console gets you back in.

More CyberPanel guides

Tested on CyberPanel 3.0 (build 8, OpenLiteSpeed edition) on Ubuntu 24.04, October 2026. Menu names can change slightly between versions.