In an attempt to harden the security of my servers, I'm taking my first steps in implementing key-based SSH logins. However, the following confused me:

After setting up my public and private key, ssh-keygen opted me to secure the private key with a password. Following my own strict password policy, I let my password manager create a strong, lenghty password (which I don't want or need to remember) and copy-pasted it into the terminal (using CTRL+SHIFT+V to paste). All well.

Then I transfered my public key to one of my servers (ProxMox running on Debian) with ssh-copy-id. Worked like a charm:

$ ssh-copy-id admin@server
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 2 key(s) remain to be installed -- if you are prompted now it is to install the new keys
admin@server's password: 

Number of key(s) added: 2

Now try logging into the machine, with:   "ssh 'admin@server'"
and check to make sure that only the key(s) you wanted were added.

Here's when my confusion starts:

  • I type the command exactly as shown above - ssh 'admin@server'
  • A full screen popup appears, telling me to "Enter password to unlock private key"
  • There's no way for me to switch to my password manager (fancy Ubuntu 20.04 fullscreen popups, yay...)
  • I hit 'Cancel' since I have no way to copy-paste the required password from my password manager
  • ...and next thing I know I'm logged in as admin@server.

How is this possible? I expected an 'access denied', 'unable to login' or 'unable to access private key', since the private key was never unlocked. But none of that - I'm just logged in. The only thing I see right after I'm logged in is this:

sign_and_send_pubkey: signing failed for RSA "/home/user/.ssh/id_rsa" from agent: agent refused operation

But after that, I can do whatever I want on the server. So... Is this how things are supposed to work? What's the point of putting a password on your private key, if it's ignored anyway? Sounds to me something is seriously broken, or am I missing something?

(P.S. - The 'sign_and_send_pubkey' message disappeared after unlocking the private key properly, but still I think I should not have been granted access to the server before the private key was unlocked, right?)

1 Answer 1


Judging by the output of ssh-copy-id, it appears that you have two private/public keypairs on your local machine. I'm guessing that one is protected by a passphrase and the other isn't. You were prompted for the passphrase for one of them but, due to cancelling the prompt, it was not decrypted. It then used the plaintext key for authentication and worked.

If you look in your ~/.ssh directory, how many files look like id_SOMETHING without the .pub extension? I'm guessing you have two and if you perform head -n 1 /path/to/private_key one will say encrypted and the other will not.

  • Thanks for your answer, @Brian Turek. My ~/.ssh directory contains just one private key, the other 3 files in the dir are the public key, known_hosts and known_hosts.old. Could this second key be located elsewhere?
    – iGadget
    Sep 11, 2020 at 9:12
  • Are there multiple *.pub files? That second key had to come from somewhere Sep 11, 2020 at 9:15
  • Nope, nothing in ~/.ssh at least. A search for .pub files only shows Android pubkeys (from scrcpy) and a google pub key I needed in the past to enable the Google apt repository. Anywhere else I can check?
    – iGadget
    Sep 11, 2020 at 10:55
  • Looking at /etc/ssh/ssh_config, I see this: Include /etc/ssh/ssh_config.d/*.conf Host * SendEnv LANG LC_* HashKnownHosts yes GSSAPIAuthentication yes. /etc/ssh/ssh_config.d/ contains no files. Anything out of the ordinary I should check?
    – iGadget
    Sep 11, 2020 at 11:25
  • 1
    It looks like you're not the only one affected by this. I wouldn't necessarily call this "bad" but it's probably not what you're wanting. You can just remove gsconnect public key from the server's authorized_keys file and then you'll only be able to connect with your passphrase protected key. You would have to do this every time you use ssh-copy-id. Sep 11, 2020 at 13:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .