One of the first things I was taught in network security was
"When installing SSH always set it to key based login only NO Password login allowed"
Passwords are not to be used here they can be broken by automated distributed attacks, strong cryptographic keys won't.