It’s been years since I was experimenting, trying to set things up properly, but at the time I could swear that I’d have the following set:

PubkeyAuthentication yes
PasswordAuthentication no
UsePam yes

and attempts to SSH into the system would still result in a password prompt, even though PasswordAuthentication was set to no. After some experimentation, I found that if I set UsePam to no, you wouldn’t get a password prompt, so that’s what I’ve been doing on every SSH server I’ve had since like, 2000.

Tinkering with it now though, I see there’s also another directive, KbdInteractiveAuthentication, which when set to no, will ensure I don’t see a password prompt even when UsePam is set to yes. I can only assume that 26ish years ago there was no KbdInteractiveAuthentication, or I just didn’t know about / notice it!

Well no harm done in my case anyway, as I don’t generally expose SSH servers to the outside world anyway. But it’s good to know that I don’t have to turn off PAM to disable password logins anymore.