What you see
user@server's password:
Permission denied, please try again.
user@server's password:
Permission denied, please try again.
user@server's password:
user@server: Permission denied (publickey,password).SSH asks three times by default, then prints the last line. The list in brackets is what the server still accepts. If it does not include password, or you never got a password prompt, you have a different problem: see Permission denied (publickey).
Test password login on its own
This rules out keys and agents, and it asks once:
ssh -o PubkeyAuthentication=no -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 user@serverCause 1: the wrong user name
Without user@, SSH sends your local user name, or the one from your config:
ssh -G server | grep '^user 'A user that does not exist gets the same password prompt and the same refusal, so it looks exactly like a wrong password. Cloud images often use ubuntu, debian or ec2-user rather than root.
To set the user once for a host, put a User line in its block of your ssh config file.
Cause 2: the wrong password
Check the obvious things: keyboard layout, Caps Lock, and hidden characters from a paste. SSH shows nothing as you type. The prompt also matters: Enter passphrase for key wants the passphrase of your key file, while user@server's password: wants the account's password on the server.
Read the server's log
If you can reach the server another way, such as a provider's console, this settles it. On Debian and Ubuntu:
sudo journalctl -u ssh -n 30On Red Hat style systems use -u sshd. Older systems log to /var/log/auth.log or /var/log/secure.
| Log line | Meaning |
|---|---|
Failed password for invalid user name | That user does not exist on the server, or is excluded by AllowUsers |
User name from ... not allowed because not listed in AllowUsers | The user exists but is not on the list |
Failed password for name | The user exists and the password check failed. It is the wrong password, or one of causes 3 and 4 |
| No line at all | You are reaching a different server or port. Check ssh -G server | grep -E '^(hostname|port) ' |
Cause 3: root may not log in with a password
The default for PermitRootLogin is prohibit-password. With this setting, sshd still shows the prompt and answers with this message even when the root password is correct, and the log says Failed password for root. So the log does not reveal the real reason. Ask sshd directly:
sudo sshd -T -C user=root,host=server,addr=203.0.113.10 | grep -i '^permitrootlogin'A result of prohibit-password or its older name without-password confirms it. Log in as a normal user and use sudo, or use a key for root. See Disable root login.
Cause 4: the account is locked
sudo passwd -S nameThe second field is L for locked, P for a usable password and NP for no password. A locked account gives the same refusal, and the log again only says Failed password. Unlock it or set a new password:
sudo passwd -u name
sudo passwd nameAn expired account gives a different text, Your account has expired; please contact your system administrator. Check it with sudo chage -l name. A nologin shell logs you in and then prints This account is currently not available.
Cause 5: AllowUsers, DenyUsers and their group versions
These rules refuse a user even with the right password. See what applies to that user, including Match blocks:
sudo sshd -T -C user=name,host=server,addr=203.0.113.10 | grep -iE '^(allowusers|denyusers|allowgroups|denygroups)'Remember to check the files in /etc/ssh/sshd_config.d/. After editing, run sudo sshd -t and reload the service.
Too many attempts
Repeated failures can lead to a new symptom: the connection stops before the password prompt. That is a penalty or a ban. See kex_exchange_identification and fail2ban.
Questions
Why does SSH say Permission denied when the password is right?
Often the user name is wrong, root may not use a password (PermitRootLogin prohibit-password), the account is locked, or AllowUsers leaves the user out. The server's log names the real reason.
How many password attempts does SSH allow?
The client asks three times by default (NumberOfPasswordPrompts). The server allows up to MaxAuthTries, 6 by default, counted across all methods.
Does a wrong user name give a different error?
No. A user that does not exist gets the same password prompt and the same refusal. Only the server's log says invalid user.
Sources
- sshd_config(5), PermitRootLogin, AllowUsers
- ssh_config(5), NumberOfPasswordPrompts
- passwd(1), Linux man-pages