i am still have troubles mastering sshd - when I login with -v I see that ssh is authenticating the following way

debug1: Authentications that can continue: publickey,gssapi-with-mic,password,hostbased

I would like to change the order ... any idea how ?

My bigger problem is that user with locked accounts, can still login via public-keys. I have found that I could add the user to a group "ssh-locked" add deny that group from sshing, but I am still wondering if there is a way to tell ssh'd : Please check password before keys ...

Thanks, Oz