Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have an Ubuntu server on Amazon EC2, that I use for development, and today I stupidly cleared everything out of the authorized_keys file for SSH. Luckily I have an SSH open, so I am still connected, and can fix the file, but when I try to put my key file back, it doesn't work. I still get permission denied from the server on my local machine.

My authorized_keys file has the permissions 600 and I have tried appending my SSH key with ssh-rsa and leaving the ssh-rsa off. I also tried making the SSH key all one line, but that didn't work either.

So is there something else that I have to do like reload the authorized_keys file some how?

share|improve this question
add comment

4 Answers

up vote 21 down vote accepted

You should never add the file with the contents starting with -----BEGIN RSA PRIVATE KEY-----, that's your private key. You must put the public key in the ~/.ssh/authorized_keys file.

This public key has the .pub extension when generated using ssh-keygen and the contents of the public key begins with ssh-rsa AAAA3B. (The binary format is describes in the answers to this question).

The permissions of ~/.ssh on the server should be 700. ~/.ssh/authorized_keys on the server are supposed to be set to 600. The permissions of the key on the client-side should be 600.

If the private key was not protected with a password and you put it on the server, I recommend you generating a new one using:

ssh-keygen -t rsa

You can skip this if you're fully sure that nobody can recover the deleted private key on the server.

If this does not help, run ssh with options for more verbosity:

ssh -vvv user@example.com

On the server side, you can review /var/log/auth.log for details.

share|improve this answer
With Amazon EC2 servers all I get is the private key (key.pem). I don't have a public key anywhere. –  Dave Long Jun 1 '11 at 17:04
@Dave Long: You must generate a new key using ssh-keygen -t rsa and put the newly created id_rsa.pub file in ~/.ssh/authorized_keys on your server. See also docs.amazonwebservices.com/AWSEC2/latest/UserGuide/… –  Lekensteyn Jun 1 '11 at 17:33
@DaveLong: You can generate the public key from the private key at any time. You can do this simply with the following command: ssh-keygen -y -f key.pem > key.pub –  Morgan Blackthorne May 17 '13 at 0:40
@MorganBlackthorne While that is true, I would recommend generating your private keys rather than accepting one from remote sources. You cannot be fully sure that the private key did not get leaked. –  Lekensteyn May 17 '13 at 8:49
I think the AAAA3B should be AAAAB3 (note the B3 vs 3B). I tried to edit, but I can't since it's only a 1 character change. –  Gabriel Dec 14 '13 at 0:01
show 1 more comment

If you have login based authentication then use ssh-copy-id to append your public keys to remote server.

ssh-copy-id user@host
share|improve this answer
That doesn't seem to be a valid command on Mac, which is what my client machine is. –  Dave Long Jun 1 '11 at 17:05
on OSX you can install with brew: brew install ssh-copy-id –  phil Nov 21 '13 at 0:26
add comment

An alternative way to install your public key in the remote machine's authorized_keys:

cat ~/.ssh/id_rsa.pub | ssh USER@HOST "mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys"

This does not require ssh-copy-id to be installed.

share|improve this answer
Your answer helped me to do this on multiple remote machines without any additional packages, thank you. –  nol Mar 7 at 10:06
add comment
local> scp .ssh/id_dsa.pub remote.com:
local> ssh remote.com
remote> cat id_dsa.pub >> .ssh/authorized_keys
remote> rm id_dsa.pub
remote> exit
share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.