VS Code Bypasses OpenSSH Server Configuration

Question

I am using an Ubuntu 24.04 server with OpenSSH. The /etc/ssh/sshd_config uses the following options:

PermitRootLogin no PubkeyAuthentication yes PasswordAuthentication no KbdInteractiveAuthentication no 

I have stored the private key (protected by a passphrase) in a non-standard location and have never told VS Code where the key is. Yet, VS Code's Remote - SSH extension lets me log into the machine with my regular user password only. No key file required.

I have restarted ssh (sudo systemctl restart ssh) and rebooted.

How is it possible that I can log in without the key?

Answer 1

I figured it out. /etc/ssh/sshd_config.d/50-cloud-init.conf was overwriting the PasswordAuthentication setting. Apparently Ubuntu creates this file during installation. Seems like an unnecessary security risk.