How to fix "Permission denied (publickey)" in SSH

See what your client offers

ssh -v user@server

Look for these lines near the end of the output:

The word in brackets in the error lists the login methods the server still allows. (publickey) alone means passwords are off, so a working key is the only way in.

Getting this from git push or git pull? See git@github.com: Permission denied (publickey).

Read the log on the server

The client is never told why a key was refused. Only the server knows. If you still have a way in, such as another session or a provider console, read the log:

sudo journalctl -u ssh -n 50     # Debian, Ubuntu
sudo journalctl -u sshd -n 50    # RHEL, Fedora, Arch
sudo tail -n 50 /var/log/auth.log   # older Debian and Ubuntu
sudo tail -n 50 /var/log/secure     # older RHEL

If the log gives no reason, run a second sshd in debug mode on a spare port. It handles one connection, prints every step, and exits. The port must be open in your firewall.

sudo /usr/sbin/sshd -d -p 2222

ssh -v -p 2222 user@server

Wrong user

Check who you are really logging in as, because a User line in your config may set it:

ssh -G server | grep '^user '

Cloud images often use a fixed account such as ubuntu, debian or ec2-user, and refuse root. A key installed for one account does not work for another, because each account has its own authorized_keys.

To fix the user and key for a host once, put User and IdentityFile in its block of your ssh config file.

Wrong key, or no key on the server

Compare fingerprints. On your machine:

ssh-keygen -lf ~/.ssh/id_ed25519.pub

On the server, this lists every key in the file:

ssh-keygen -lf ~/.ssh/authorized_keys

If the fingerprint is missing, install the key. While password login still works, one command does it, with the right permissions:

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server

If the server takes only keys, add it from a provider console or another session, as that user. Put your whole .pub line in place of the example:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo 'ssh-ed25519 AAAA... you@laptop' >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

If the key is there but your client offers others first, name it and ignore the rest:

ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 user@server

A common mistake when installing by hand is a key split over two lines. Each key must be on one line: see the authorized_keys file explained.

Permissions and ownership

With the default StrictModes yes, sshd ignores authorized_keys if other users could write to it or to the directories above it. Group write on the home directory is enough to trigger it. On the server, as the user:

chmod go-w ~
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

If you created the files with sudo, fix the owner as well:

sudo chown -R user:user /home/user/.ssh

To see every level of the path at once:

namei -l /home/user/.ssh/authorized_keys

On systems with SELinux enforcing, such as RHEL and Fedora, files moved into place can also carry the wrong label. Reset it with restorecon -Rv ~/.ssh.

AuthorizedKeysFile points elsewhere

Your key may be in the right file for the default setup, but not for this server. Ask sshd what applies to this user. -C also evaluates any Match blocks:

sudo sshd -T -C user=user,host=example.com,addr=203.0.113.10 | grep -iE '^(authorizedkeysfile|pubkeyauthentication) '

The default is .ssh/authorized_keys .ssh/authorized_keys2, relative to the home directory. A value like /etc/ssh/authorized_keys/%u means the key has to go there instead. Also check that pubkeyauthentication says yes.

Old RSA and PubkeyAcceptedAlgorithms

OpenSSH 8.8 turned off the ssh-rsa signature, which uses SHA-1, by default. This disabled the old signature, not RSA keys. An RSA key still works when both sides support rsa-sha2-256 or rsa-sha2-512, which OpenSSH has supported since version 7.2.

If a new client meets a server too old for that, ssh -v shows a line such as no mutual signature algorithm, and the key is never offered. Upgrading the server is the real fix. Until then, allow the old signature for that one host in ~/.ssh/config:

Host oldbox
  PubkeyAcceptedAlgorithms +ssh-rsa
  HostKeyAlgorithms +ssh-rsa

If an old client connects to a new server, the same line goes in sshd's configuration, and affects every user of that server:

PubkeyAcceptedAlgorithms +ssh-rsa

Before OpenSSH 8.5 the option was called PubkeyAcceptedKeyTypes. If you can, switch to an ed25519 key and remove these lines.

Questions

How do I add my SSH key to the server?

Run ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server while password login still works. If the server accepts only keys, append your .pub line to ~/.ssh/authorized_keys from a provider console, then run chmod 600 on the file.

Why does SSH say Permission denied (publickey) when the key is on the server?

Usually permissions: sshd ignores authorized_keys if others can write to the home directory, .ssh or the file. Also check that the key is in the file of the account you log in as.

How do I see which key SSH is offering?

Run ssh -v user@server and look for the Offering public key lines. To use only one key, add -o IdentitiesOnly=yes and -i with its path.

Do RSA keys still work with recent OpenSSH?

Yes. OpenSSH 8.8 turned off the old ssh-rsa signature with SHA-1, not RSA keys, which work with rsa-sha2-256 or rsa-sha2-512.

Sources

• ssh(1), OpenBSD manual
• sshd(8), OpenBSD manual
• sshd_config(5), OpenBSD manual
• OpenSSH 8.8 release notes
• OpenSSH 8.5 release notes

Related guides

• How to generate an ed25519 SSH key
• The authorized_keys file explained
• "git@github.com: Permission denied (publickey)": how to fix it
• SSH "Too many authentication failures": how to fix it
• WARNING: UNPROTECTED PRIVATE KEY FILE: how to fix bad permissions
• The SSH config file, with examples

More in Keys and login

• How to convert a .ppk key to OpenSSH, and back
• How to disable password login for SSH
• How to use a YubiKey or FIDO2 key with SSH (ed25519-sk)
• How to add an SSH key to GitHub
• How to recover an SSH public key from the private key
• RSA vs ed25519 SSH keys: which should you use?

All guides