Disabling password auth is the step people skip

Adding a key to authorized_keys makes key login work. It does not stop password login from also working, so the server is still one weak password away from compromise and the key has changed nothing about its exposure.

# /etc/ssh/sshd_config
PasswordAuthentication no
ChallengeResponseAuthentication no
PermitRootLogin no
UsePAM yes

Confirm the key works in a second session before reloading sshd — with the first one still open, a mistake is recoverable. ChallengeResponseAuthentication is the one that catches people: leaving it on can allow a password through keyboard-interactive even after PasswordAuthentication no. Once this is set, the constant brute force traffic in auth.log becomes noise rather than risk.