Why would a ssh password-based login fail?

Question

I currently use ssh keys to connect to my server (Ubuntu 18.04). I would like to allow (in a specific, limited scope) the ability to login with passwords.

Whenever I try, my passwords fail. below is a session where I set a password, then try to use it:

~ # id
uid=0(root) gid=0(root) groups=0(root)

~ # passwd
Enter new UNIX password: <helloworld>
Retype new UNIX password: <helloworld>
passwd: password updated successfully

~ # ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no [email protected]
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:AlFtwpK4EhhaMXP5aT6fuQM9u9RYPq/o/sLJXfz++jM.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
[email protected]'s password: <helloworld>
Permission denied, please try again.

I apologize if this is something obvious, I have no clue why the server accepts a new password, then accepts a password-based login to finally reject the credentials.

EDIT: the sshd_config file I failed to add

~ # cat /etc/ssh/sshd_config | grep -v ^#  | grep -v ^$                                                                                                                  root@srv
Port 22
PasswordAuthentication no
ChallengeResponseAuthentication no
GSSAPIAuthentication no
UsePAM yes
PrintMotd no
UseDNS no
AcceptEnv LANG LC_*
Subsystem       sftp    /usr/lib/openssh/sftp-server
Match Address 192.168.10.0/24,192.168.20.0/24,127.0.0.0/8
    PasswordAuthentication yes

Answer 1

The login failed, because there is no setting for PermitRootLogin in /etc/ssh/sshd_config which defaults to prohibit-password, which means password login is disabled for root.

Adding

PermitRootLogin yes

to the Match block would allow root to login with password or public key authentication.

Another option would be to use a different user.