I’ve asked some web hosting providers (Bluehost and Dreamhost) and they both said that on shared hosting accounts they have no way to disable login via SSH with a password. What this means is that even if we set up SSH keys, logging in without them and via the hosting’s password will always be enabled, pretty much negating most of the advantage for the keys.
From what I can find online, editing
/etc/ssh/sshd_config is the way to go do disable login via a password, but since it’s shared hosting, that’s not a possibility.
All that said, they never claimed it can’t be done (though I haven’t found a way), just that they don’t support it. Is there a way to do it on a per-user basis, so that I can set it up myself? And if not, why not, what is the (technical/design) limitation in the way SSH works that prevents it?