I think I understand the difference between Public Key authentication and Password. But how do I decide which one to use and which one is most secure in what situation? Can anybody give me some real life example about when to choose public key and when to choose password?
But how do I decide which one to use and which one is most secure in what situation?
A public key is probably always more secure than a password, as long as the corresponding private key has a password. This way, even if someone acquires the private key, it's still not usable unless they also have the password, whereas with a password, that's all that's needed.
However, brute forcing a password for a stolen key is probably easier than brute forcing a password for an ssh login, since the later will be slower and obvious -- the server will note the repeated failures and can restrict and report the attacker's IP. A 10 character password using Base64 characters has 64^10 = 1152921504606846976 possibilities, so it may be feasible for a clever person to crack this, if they can try it with their own equipment on a copy of the key.
Of course, you can't force users to password protect their private keys (unless you issue them). But you can't force people to be careful with passwords generally, so a password alone doesn't really solve the "irresponsible user" problem.
Can anybody give me some real life example about when to choose public key and when to choose password?
Some people find keys a hassle because you need to store them. Using a password login is its own hassle, though, if you frequently log in and out, since you must re-type the password each time.
Which to use is rather simple.
Key based authentication is generally better as goldilocks has stated. But it effectively binds a user on machine 1 to a specific user on machine 2. Therefore it can be a giant pain in the back side if you need an unknown number of users or unknown number of machines to login.
A good example of when to use passwords would be a server in which it's mission critical to be able to access no matter where you are or what kind of device your using. So when you need access to that server you can get it, via cell phone, toaster oven, friends computer, public computer, or other place that you don't want to permanently "grant access" to.
That said, that server would obviously be a security weak point. Most people and circumstances should use keys. Passwords do have their uses though.