Planning key-based administrator access before disabling SSH passwords

Confirm a working provider console, protect private keys and inventory automated SSH/SFTP jobs. Test the intended key-based administrator login in a completely new connection, including any required privilege elevation.

1. Install and authorise the correct public keys using the supported account or root-key management workflow. Keep private keys on the authorised client or protected secret system.
2. Open a second SSH connection that explicitly uses the key and verify it reaches the correct server account. Do not count an already established session as proof.
3. Update backup, deployment and monitoring jobs that still depend on an SSH password. Test each replacement method.
4. Open SSH Password Authorization Tweak in WHM and disable password authentication when the inventory is ready.
5. Test a fresh key-based login again and confirm password-based login is rejected as intended. Keep the recovery console available until all critical integrations pass.

Authorised key access should continue while SSH password authentication follows the new policy. WHM browser passwords and unrelated service logins are separate authentication paths.

If key authentication fails, use the retained administrative session or provider console to restore the approved configuration and inspect key ownership, permissions and daemon settings. Do not close the only working access path before testing.

No. Password policy does not invalidate authorised public keys. Remove the compromised key from every affected account and inspect sessions and related credentials separately.

• Granting or removing jailed shell access for an account
• Adding an SSH public key to a cPanel account
• Restricting a management service through WHM Host Access Control
• Enabling or disabling cPanel features through WHM

• cPanel: SSH Password Authorization Tweak
• cPanel: SSH Access