Enabling and disabling SSH password login

How to switch your server to key-only login, or turn password login back on, safely from the panel.

The “Disable password login” and “Enable password login” buttons are on the server card, on the “My Servers” page of the app.blackbox.md panel (app.blackbox.md/my-servers, sidebar → “Infrastructure” → “My Servers”). With them, you choose whether the server accepts SSH connections with a key only, or with the root password as well. From blackbox.md you can go straight to the card through “Contul meu” (My account) → “Comenzi” (Orders) → “Gestionează în app.blackbox.md” (Manage in app.blackbox.md).

Available to: the blackbox.md account holder who ordered the server, or an account that BLACKBOX has given management rights for the server. The buttons are not shown on cards marked “Managed”; write to us.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

What you see on the card

Next to the server's name, a badge shows the current SSH login mode. Among the card's buttons is the one that changes it:

Badge	What it means	Button on the card
“Key-only”	SSH password login is disabled. You connect only with an installed key.	“Enable password login”
“Password + key”	Both the root password and the installed keys work.	“Disable password login”
no badge	The panel doesn't know the server's SSH state.	none

The badge and the button appear only when the panel knows the server's state. If they're missing, open “Add SSH key” on the same card: when the “Installed keys” list loads, the panel checks the server and, if the check succeeds, shows them.

What changes on the server

The panel writes the SSH settings managed by BLACKBOX to the server, in a file in the /etc/ssh/sshd_config.d/ directory:

Action	Result
Disabling	SSH password login is turned off for all users, and `root` can connect only with a key.
Enabling	Password login works again: you can connect as `root` with the root password. Installed keys keep working.

The panel checks the new settings, reloads the SSH service and confirms the applied value. If any step fails, the previous settings are restored and nothing changes on the server. SSH sessions that are already open are not interrupted: the new rule applies to the next connections.

The root password is not deleted. The phrase “The console password still works” in the confirmation means only this: the root password stays set on the server and saved in the panel, where you can see it with “Reveal credentials”. Over SSH, it works again after “Enable password login”. There is no web or VNC console for customers.

Switching to key-only login is part of Securing a new server: checklist.

Warning Before disabling, install your own SSH key on the server and check in a second terminal that you can connect with it. The panel can't do this check for you. Keep that session open until you've confirmed that everything works after the change.

On the server card, open “Add SSH key” and check the “Installed keys” list. Your key must be there: compare the start of its fingerprint (SHA256:…) with the output of the command below, run on your computer (for an RSA key, the file is ~/.ssh/id_rsa.pub). You can't use the “Management key (blackbox.md)” or the other BLACKBOX keys to connect yourself (see BLACKBOX keys on your server). If your key is missing, add it: Adding and removing SSH keys on the server.
```
ssh-keygen -lf ~/.ssh/id_ed25519.pub
```
In a new terminal, connect using only the key. If you see Permission denied, the key doesn't work: don't continue.
```
ssh -o PreferredAuthentications=publickey root@SERVER_IP
```
Leave this session open.
In the panel, click “Disable password login”.
The browser asks you to confirm “Disable SSH password login on SERVER_NAME? After this, only installed SSH keys can log in. The console password still works.”, where SERVER_NAME is the server's name on the card. Click “OK”.
While the change is being applied, the button is inactive. There is no separate success message: the badge changes to “Key-only”, and the button changes to “Enable password login”.
From a new terminal, check that you can log in with the key (the command from step 2) and that the password is refused. The command below must end with Permission denied without asking you for a password:
```
ssh -o PubkeyAuthentication=no root@SERVER_IP
```
Close the session from step 2 only after these checks.

On the server card, click “Enable password login”.
Confirm “Re-enable SSH password login on SERVER_NAME?” with “OK”.
The badge changes to “Password + key”, and the button changes to “Disable password login”.
Show the root password with “Reveal credentials” (see Showing root credentials) and connect:
```
ssh root@SERVER_IP
```

If you changed the root password on the server with passwd, the panel shows the old password. Generate a new one with “Reset password” (see Resetting the root password). While password login is on, your server will be a target of password-guessing attempts: use a long password and see Protection against password-guessing attempts with fail2ban.

Checking on the server

You can see the value that SSH actually applies with:

sshd -T | grep -i passwordauthentication

The output is passwordauthentication no for “Key-only” and passwordauthentication yes for “Password + key”.

Important Don't change PasswordAuthentication manually in /etc/ssh/sshd_config. The panel's settings take precedence, so your change may have no effect. Change the setting only with the buttons on the card.

The badge shows the last state the panel knows. The panel rereads the server's actual SSH configuration when you open “Add SSH key” and the “Installed keys” list loads; if the setting was changed directly on the server, the badge and the button are corrected. To check again, reload the page and open “Add SSH key” again.

Limits and errors

You can change the setting at most 5 times in 5 minutes, for all the servers in your account together. Every attempt counts, including failed ones. Errors appear in a red box on the card.

Message	What it means	What to do
“No installed key found — add a key before disabling password login.”	The panel found no installed key on the server and refuses to disable password login.	Add your key with “Add SSH key”, test that you can connect, then try again.
“We couldn't verify our management key — this action is unavailable right now.”	The panel can't confirm this server's management key and, as a precaution, changes nothing.	Write to us at support@blackbox.md.
“Failed to change password login.”	A general message. Possible causes: you've gone over 5 attempts in 5 minutes; another change is already in progress for the same server (for example, from another tab or through the AI assistant); the server is stopped or the panel can't connect to it; the new settings failed the check and the previous ones were restored.	Wait 5 minutes, then try again. If the server is stopped, start it first with “Start”. If the message repeats, write to us.

If you can no longer connect

As long as the panel's buttons work, click “Enable password login” and connect with the password shown by “Reveal credentials”. If that doesn't work either, follow Lost access to your server (password or key).

Frequently asked questions

Do the panel's buttons also work on a “Key-only” server? Yes. The panel doesn't connect with the password but with its own key, shown in “Installed keys” as “Management key (blackbox.md)”. Don't delete this key from the server.

I clicked “Reset password” on a “Key-only” server, but the new password doesn't work over SSH. Why? Resetting changes only the root password. SSH password login stays disabled until you click “Enable password login”.

Does disabling also affect other users, not just root? Yes. No user can connect over SSH with a password anymore, so users without an installed key lose SSH access.

Can I change the setting through the AI assistant? Yes, with the same checks. See SSH access and SSH keys through the AI assistant.

Can I choose “key-only” right when I order? Yes. See The SSH key at order time and “key-only” servers.