In the main /etc/ssh/sshd_config file, there is a comment:
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the KbdInteractiveAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via KbdInteractiveAuthentication may bypass
# the setting of "PermitRootLogin prohibit-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and KbdInteractiveAuthentication to 'no'.
UsePAM yes
If your configuration did not disable KbdInteractiveAuthentication, it allows PAM to perform the equivalent of password authentication through a slightly different code path that's originally intended for challenge/response-type authentication modules... but technically "display a password prompt" can be a challenge, and "enter a valid password" a valid response to it.
The default configuration should include an uncommented KbdInteractiveAuthentication no, but try
diff -u /usr/share/openssh/sshd_config /etc/ssh/sshd_config
to double-check that your current main sshd configuration file actually matches the default one.
Also, note that the default behavior of sshd when password authentication is disabled is to still display a password prompt. In this situation, the prompt will be completely fake and its only purpose is to make an intruder waste their time futilely trying to guess passwords. So if you see a password prompt, it does not necessarily mean password authentication is actually available.
If you feel this is not useful, you could add AuthenticationMethods publickey to your realtebo.conf to stop sshd from even offering any password prompt (neither fake nor real).
- cannot login using pubkey
The new version has a new default PubkeyAcceptedAlgorithms setting. It's long, but more notable in what it doesn't include (quoted from man sshd_config):
PubkeyAcceptedAlgorithms
[...]
The default for this option is:
[email protected],
[email protected],
[email protected],
[email protected],
[email protected],
[email protected],
[email protected],
[email protected],
ssh-ed25519,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
[email protected],
[email protected],
rsa-sha2-512,rsa-sha2-256
Notably the old standbys, ssh-rsa and ssh-dss, are no longer there by default. You can still add them in if you need to, and in your case, adding ssh-rsa might help... but if that's the case, you really should update your SSH client to a version that supports the rsa-sha2-* public key algorithms. Your existing key is fine, just the algorithm it's used in needs an upgrade.
So, you might try adding two settings to your /etc/ssh/sshd_config.d/realtebo.conf:
KbdInteractiveAuthentication no
PubkeyAcceptedAlgorithms +ssh-rsa
If pubkey authentication still doesn't work after that, use journalctl -u ssh.service to view the messages logged by sshd to see exactly why it rejects your public key.
(Yes, the name of service that runs sshd is indeed ssh.service in Debian and derivatives, rather than sshd.service as in RHEL/Fedora and their derivatives. Historical reasons. Silly, but that's life.)
Note that you can view the effective sshd configuration by running sshd -T. If your configuration includes any Match conditionals, you can add -C keyword=value style options to provide the necessary information for those conditions, to check how matching the conditions affects the effective configuration in each case. See man sshd for more details.
