SSH Permission Denied: Fix Public Key Authentication

Symptoms

When attempting to connect to a remote server via SSH using public key authentication, you receive the error: Permission denied (publickey). The connection fails even though the public key has been added to the authorized_keys file. Common symptoms include:

• SSH client prompts for password (if password authentication is enabled) or immediately disconnects.
• Verbose SSH output shows Authentication refused: bad permissions or key not found.
• Connection works with password but not with keys.

Root Causes

1. Incorrect File Permissions

OpenSSH is strict about permissions on the user's .ssh directory and its contents. If permissions are too permissive (e.g., world-writable), the server rejects the key for security reasons.

• ~/.ssh directory must have permissions 700 (drwx------).
• ~/.ssh/authorized_keys file must have permissions 600 (-rw-------).
• The user's home directory must not be writable by others (typically 755 or 700).

2. Wrong Ownership

All files in ~/.ssh must be owned by the user, not root or another user.

3. Incorrect Key Format or Location

The public key in authorized_keys must be a single line, exactly as generated. Extra spaces, line breaks, or comments can cause failures. Also, the private key on the client must be in the correct location (default ~/.ssh/id_rsa) or specified with -i.

4. SSH Server Configuration

On the server, /etc/ssh/sshd_config must have PubkeyAuthentication yes. Also, AuthorizedKeysFile should point to the correct path (default .ssh/authorized_keys).

Step-by-Step Fix

Step 1: Check Permissions on the Server

Log in via another method (e.g., console or password if enabled) and run:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod 755 ~

Ensure the home directory is not world-writable:

ls -ld ~

Should show drwxr-xr-x or drwx------.

Step 2: Check Ownership

chown -R $USER:$USER ~/.ssh

Step 3: Verify the Public Key

Open ~/.ssh/authorized_keys and ensure it contains exactly one line per key, starting with ssh-rsa, ssh-ed25519, etc. No trailing spaces.

Step 4: Test with Verbose Output

From the client, run:

ssh -vvv user@host

Look for lines like debug1: Offering public key and debug1: Authentication refused: bad permissions.

Step 5: Check Server Logs

On the server, check /var/log/auth.log or /var/log/secure for details.

Alternative Fixes

• Use ssh-copy-id: This tool automatically sets correct permissions: ssh-copy-id user@host.
• Disable StrictModes: As a temporary workaround, set StrictModes no in /etc/ssh/sshd_config and restart SSH. Not recommended for production.
• Check SELinux: On Red Hat-based systems, SELinux may block. Run restorecon -R -v ~/.ssh.

Prevention

• Always use ssh-copy-id to install public keys.
• Set up a configuration management tool (Ansible, Puppet) to enforce correct permissions.
• Regularly audit SSH permissions and ownership using scripts.
• Use Ed25519 keys for better security and compatibility.

By following these steps, you can resolve the 'Permission denied (publickey)' error and ensure secure, reliable SSH key authentication.