Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup ssh authentication with key files in stead of username/password. The client is a Windows box running PuTTY and the server is a Ubuntu 12.04 LTS server.

I downloaded puttygen.exe and had it generate a key pair. In /etc/ssh/sshd_config I have this line:

AuthorizedKeysFile %h/.ssh/authorized_keys

and on my client's public key file it says this:

Comment: ""
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAr3Qo6T5XU06ZigGOd3eKvfBhFLhg5kWv8lz6

I copied the part from "ssh-rsa AAA" to "" and put that in the file ~/.ssh/authorized_keys on my server (in my own homefolder). In PuTTY under Connection > SSH > Auth I entered the path to the private key it generated on my client and saved the session settings.

I restarted the ssh server with

sudo service ssh restart

Now if I load the profile in PuTTY (I verified the private key is still in Connection > SSH > Auth and that the path is correct) and run the profile, it says

Server refused our key

I tried putting the public key in a file under the directory ./ssh/authorized_keys/ but that didn't help so I used ./ssh/authorized_keys as a file, pasting the key in it. I also tried generating a private/public key pair on the server, putting the public key in ./ssh/authorized_files and loading the private one in PuTTY on my client. Rebooting the server didn't help either.

I found that the error may be solved by putting the key in a place outside the user's home folder but that's only useful if the home folder is encrypted, which this one is not.

Also tried generating a 4096 bit key, thinking perhaps 1024 was too short.

How can I get this to work? Thanks!


Ok, /var/log/auth.log said:

sshd: Authentication refused: bad ownership or modes for directory /home/vorkbaard/.ssh

Google tells me ~/.ssh/ should be 700 and and ~/.ssh/authorized_keys should be 600, so I did that. Now /var/log/auth.log says:

sshd: error: key_read: uudecode AAAAB3N [etc etc etc until about 3/4 of my public key]
share|improve this question

14 Answers 14

up vote 44 down vote accepted

Ok, it is fixed however I don't see how this is different from what I tried already.

What I did:

  • generate a key pair with puttygen.exe (length: 1024 bits)
  • load the private key in the PuTTY profile
  • enter the public key in ~/.ssh/authorized_keys in one line (needs to start with ssh-rsa)
  • chmod 700 ~/.ssh
  • chmod 600 ~/.ssh/authorized_keys
  • chown $USER:$USER ~/.ssh -R
  • change /etc/ssh/sshd_config so it contains AuthorizedKeysFile %h/.ssh/authorized_keys
  • sudo service ssh restart

For troubleshooting do # tail -f /var/log/auth.log.

Thanks for your help!

share|improve this answer
Hmm, so what happened to that sshd: error: key_read: uudecode AAAAB3N error in auth.log? – Alaa Ali Jun 11 '13 at 13:27
I haven't a clue, Alaa. Perhaps I made an error pasting the previous key string. Auth.log doesn't get any more entries now and key based authentication works flawlessly. My main problem was that I wasn't really sure about what needed to be done, making the how that much more difficult. So I don't know why but it works. Thanks again for your help :) – Captain Forkbeard Jun 11 '13 at 18:23
Awesome!!! I have been scratching my head for 2 days. This answers saves the day!! – naka Jul 24 '14 at 12:56
Step 3 was the trick for me. I didn't put the public key in the authorized_keys file I just pasted my file into the ~/.ssh folder and thought it would pick it up. Instead what I needed ultimately was to run this or edit and paste in below other keys that may be in there. cat >> authorized_keys. Seems simple now, but lesson learned is all public keys have to live in authorized_keys not just in the ~/.ssh/ directory. Someone please advise if this is not a correct assertion. – timbrown Aug 14 '14 at 19:22
if the steps doesn't help, check also: 1. you copied the saved PuTTY public key into authorized_keys, not the OpenSSH one 2. if you copied using copy/paste from PuTTYgen (which you should do), you may have split the public key in multiple lines; it should be a single line; make sure you did not add leading or trailing spaces while copying thanks to r_hartman – mvladk Sep 30 '14 at 10:28

I had to change the ~/.ssh directory permissions from 770 to 700 and the ~/.ssh/authorized_keys file permissions from 660 to 600.

For some reason removing group permissions fixed this issue for me.

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
share|improve this answer

I had to change permissions to home directory

chmod 700 ~
share|improve this answer
This worked for me as well (on AIX though). – stevepastelan Feb 19 '15 at 18:44

the problem is that windows uses a different new line than linux, so when copying the key from windows to linux, there is a \n at the end of the line that you can not see on linux in the editor.

If you tail the /var/log/auth.log and try to login, the error is like:

sshd: error: key_read: uudecode AAAAB3N[....]==\n

If you change your key on windows so its in a single line without a new line at the end and copy it then to linux, it should work (did the trick for me).

share|improve this answer

I just encountered this problem. Despite having the config set correctly as is already mentioned in this thread (permissions on authorized_keys etc.), it turns out I had the public key in the wrong format. It was in the form of:

Comment: "imported-openssh-key"
... lPmTrOfVTxI9wjax2JvKcyE0fiNMzXO7qiHJsQM9G9ZB4Lkf71kT

Which wasn't working. But got it working having it in the form:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDU.....j0N3vuLpeviGvZTasGQa1rcJiPXQMW7v3uurb+n94B9MQaaWR0odsg5DJQL92TNenOda5BO1nd08y6+sdLQmHXExTz6X8FzgoVsAkEl3RscxcxHUksiKA9JfTo38vQvG/bPxIHMCuSumCQVA1laf3rO/uOrkcB7iMWhaoi1/z6AbFtPzeh7xjGfInMWwtBI0CsHSRF73VWIxT26w0P+KjafCjSn/7vDO1bT8QHujSQelU/GqaVEvbbvPl1a7POVjKgHLNekolwRKfNeVEewcnmZaoqfHgOKlPmTrOfVTxI9wjax2JvKcyE0fiNMzXO7qiHJsQM9G9ZB4Lkf71kT UserName@HOSTNAME
share|improve this answer
You can use ssh-keygen -i -f filenameofwindowsformpub.key to transform the public key into the format understood by your OpenSSH server. – Black Dec 23 '15 at 9:24
Yes, it worked for me! It has to be in a single line. Can't believe it was only that! – adelriosantiago Jul 20 at 4:19

The ~/.ssh/authorized_keys file requires keys to be all on one line. If you added it across multiple lines as in your paste above, try joining the lines.

share|improve this answer
Thanks, that makes sense and now I understand why it is a file, not a directory. However it didn't help. – Captain Forkbeard Jun 11 '13 at 12:07

In addition to all the above answers, make sure you copy and paste the key from puttygen correctly!

If you just double-click on the bulk of the key string to select it, you may not get the entire string, because the text box splits lines on some characters, like +, such that you don't select the text after the + character (which you can't see because the text box is too small). Be sure to select the entire string manually, from the ssh-rsa to the very end of the text box.

share|improve this answer

Sometimes it can be a problem associated with having the public key on one line, this approach seems to solve it

echo 'the content of the public key' > /root/.ssh/authorized_keys
share|improve this answer

for me the problem was i'd created ~/.ssh/authorized_keys using root so root owned. I had to chown sshuser:sshuser ~/.ssh/authorized_keys then it started working

share|improve this answer

I too faced this error and solved it by changing the permissions of authorized_keys file to 600.

chmod 600 ~/.ssh/authorized_keys
share|improve this answer

Here's what worked for me:

In puttygen, after you've generated your keys, make sure that you copy and paste the information from the top field to go into your authorized_keys file. If you save your public key to your client machine, and then open it up, the text is different from the text at the top of the puttygen screen. Again, make sure that you copy and paste the text from the TOP of the puttygen screen (after you've created your keys) into your authorized_keys file which should be located in ~/.ssh.

share|improve this answer

After going through the steps above, I realized that I was creating the .ssh and authorized_keys files while logged in as root, which I didn't want to login using root. Which gave the ownership to root and also placed all the files under the root directory. I believe is the root of a lot of peoples problems with "server refused key"

Changing ownership of those files to the user you desire won't be good practice, so I retraced my steps and made sure I was logged in as the user I wanted to utilize SSH with and created .ssh and authorized_keys again...newbie mistake :) Hopefully this helps another beginner.

I followed these directions to connect Win7 to Xubuntu 15.04:

share|improve this answer

Common error is that people uses text editor (like Vim) and paste the copied text before activating the "insert" (press +i in Vim before pasteing)

share|improve this answer

In fact, I changed authorized_keys's permission to 644, then problem solved.

chmod 644 ~/.ssh/authorized_keys
share|improve this answer

protected by Community Mar 3 at 13:35

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.