I am trying to connect to a Linode (running Ubuntu 12.04 LTS) from my local machine (also running Ubuntu 12.04 LTS)

I have created a private and public key on my local machine and copied my public key to my Linode's authorized_keys file. However, whenever I try to ssh to my Linode I get the error message Permission denied (publickey).

It's not a problem with how ssh is set up on my Linode because I can ssh to it from my Windows machine using key authentication.

In my .ssh directory on my local Ubuntu machine, I have my id_rsa and id_rsa.pub files. Do I need to create an authorized_keys file on my local machine?

EDIT: This is what I get when I run ssh -vvv -i id_rsa [youruser]@[yourLinode]:

debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).
  • 7
    1) What do the logs on the SSH server say about the time you have this error on the client? (/var/log/auth.log) 2) How did you transfer the public key to the server? Always use ssh-copy-id to be sure about permissions. Your home directory, the .ssh directory and the authorized_keys file have strict permission requirements. (see manpage of sshd (8) on ~/.ssh/authorized_keys). 3) Did you generate a new keypair on Ubuntu? In case you reused the key from Windows - you'll have to convert it to OpenSSH format first.
    – gertvdijk
    Jun 23, 2013 at 1:13
  • 2
    The command should have been ssh -vvv -i .ssh/id_rsa .... (note the path to id_rsa!) - please replace - the old log only shows that "we" had no pubKey to send.
    – guntbert
    Jun 23, 2013 at 11:22
  • @guntbert I missed out the .ssh because I was already in the .ssh directory. I also tried it with .ssh/id_rsa but I got the same result
    – Pattle
    Jun 23, 2013 at 11:30
  • 1
    I had same problem. I could log on as root but not as new_user. If you can access your server as root or a sudo user you can watch the ssh auth log via "tail -f /var/log/auth.log". in my case the problem was the new_user was configured with an invalid shell. "user new_user not allowed because shell /bin/ is not executable".
    – Bryan
    Feb 16, 2022 at 16:41
  • 1
    (not enough reputation to post as an answer) More recently, this can also happen due to the SHA-1 signature in RSA keys becoming deprecated. Running ssh -vvv will report "no mutual signature algorithm" if this is the case. To fix, either update your ssh server to support rsa-sha2, or regen your key with ssh-keygen -t ed25519, or pass -o PubkeyAcceptedKeyTypes=+ssh-rsa to the ssh client.
    – Sir Athos
    Apr 26, 2023 at 9:26

22 Answers 22



Set up your client

  1. Generate your key.

  2. Configure ssh to use the key.

    vim ~/.ssh/config

    Your config file should have something similar to the following:

    Hostname ip-or-domain-of-server
    PubKeyAuthentication yes
    IdentityFile ./path/to/key

    You can add IdentitiesOnly yes to ensure ssh uses the specified IdentityFile and no other keyfiles during authentication. Setting IdentitiesOnly prevents failed authentications from occurring, when ssh would otherwise attempt to login with multiple keys. Setting this is also considered more secure, as you're not leaking information about other keys you have installed, and maintaining separation of your keys between different levels of access.

  3. Copy your key to your server.

    ssh-copy-id -i /path/to/key.pub SERVERNAME`

    For example, ssh-copy-id -i ~/.ssh/id_res.pub -p 22 [email protected]


  1. use "-vvv" option
  2. Make sure the server has your PUBLIC key (.pub).
  3. Make sure your IdentiyFile points to your PRIVATE key.
  4. Make sure your .ssh directory has 700 and the files within are 600 permissions.
    • ssh-keygen will create files and directories for you with the proper permissions
  5. tail -f /var/log/auth.log (on the server) and monitor errors when you attempt to login
  6. If you have many key files, try IdentitiesOnly yes to limit the authentication to use the single, specified key.
  • 4
    FYI, I created a small script at github.com/centic9/generate-and-send-ssh-key which runs the necessary steps in one go and additionally ensures all the file/directory permissions which always caused me headaches...
    – centic
    Oct 7, 2015 at 11:30
  • 6
    Just to elaborate step 2: the IdentityFile line in ~/.ssh/config must point to the PRIVATE key. Aug 30, 2017 at 14:19
  • 6
    I wonder why you'd want to set files to have execute permission in step 4? Nov 7, 2018 at 13:43
  • 2
    Posterity and completeness is why.
    – earthmeLon
    Sep 28, 2019 at 21:48
  • 6
    While the directory requires 700 permissions, the files do not, they should be 600. Oct 24, 2020 at 10:13

Sometimes the issue comes from permissions and ownership. For instance, if you want to log in as root, /root, .ssh and authorized_keys must belong to root. Otherwise, sshd won't be able to read them and therefore won't be able to tell if the user is authorized to log in.

In your home directory:

chown -R your_user:your_user .ssh

As for rights, go with 700 for .ssh and 600 for authorized_keys

chmod 700 .ssh
chmod 600 .ssh/authorized_keys
  • 4
    This answer helped me. I had taken the advice from this post and moved my authorized_keys file outside of my encrypted home directory. In doing so, I had inadvertently changed ownership to root:root. Aug 12, 2016 at 22:27
  • 4
    Wish I could upvote twice, once for the folder and once for the file. Very important that permissions are exact.
    – Mr Griever
    May 15, 2019 at 18:21
  • I changed the permission of my home folder /home/user to 777 by mistake, this make ssh failed. chmod 777 /home/user will fix it. Jul 2, 2023 at 18:01

The problem I had was it was using the wrong keys on the client. I had renamed id_rsa and id_rsa.pub to something else. You can either rename them back to their default, or when you issue the ssh command, use it like this

ssh -i ~/.ssh/private_key username@host
  • 1
    no, use the public key
    – St3an
    Dec 3, 2018 at 9:58
  • 12
    @St3an you put the public key on the server, but when you connected like Todd is here above, you use your private key
    – Nathan F.
    Apr 10, 2019 at 21:50
  • @NathanFiscaletti you must never expose your private key, that's why it's private. The private key is used by your local ssh agent to check that you really give a public key that correspond to your private one. SSH agents between machines can then guarantee that users are who they pretend to be :-)
    – St3an
    Apr 11, 2019 at 8:26
  • 15
    Exactly. Which is why when you connect, you provide your private key to the ssh-client. The server stores your public key. The command in the post above is exactly how private keys are supposed to be used.
    – Nathan F.
    Apr 11, 2019 at 14:54
  • This works like a charm, and finally solved my first connection to the server.
    – p3nchan
    Jul 8, 2021 at 11:48

You don't need authorized_keys on your client.

You must tell the ssh-client to actually use the key you generated. There are several ways to do that. Just for testing type ssh -vvv -i .ssh/id_rsa [youruser]@[yourLinode]. You will have to provide your passphrase every time you want to connect to the server.

If that worked you can add the key to the ssh-agent with ssh-add .ssh/id_rsa (you will have to provide the passphrase only once for this and it should work as long as you don't logout/reboot)

  • Thanks for your help, I have edited my answer to show what happens when I type what you suggested.
    – Pattle
    Jun 22, 2013 at 23:22
  • 2
    to transfer a key, on the client, use ssh-copy-id
    – Panther
    Jun 23, 2013 at 0:30
  • @bodhi.zazen Thanks, but I have already transferred the key, that isn't the problems
    – Pattle
    Jun 23, 2013 at 0:33
  • 4
    "You must tell the ssh-client to actually use the key you generated." No, by default it will look for the key in the default path, e.g. ~/.ssh/id_rsa. Also, the use of a key agent is completely optional and unrelated to the issue as far as I can see.
    – gertvdijk
    Jun 23, 2013 at 1:09
  • @gertvdijk, you are making assumptions here which are not backed by facts yet - we don't know what happened on the system.
    – guntbert
    Jun 23, 2013 at 11:24

Also check value of PasswordAuthentication in /etc/ssh/sshd_config and if it's no change it to yes. Don't forget to restart ssh service after that.

  • 30
    The OP is not trying to use password authentication. They have some sense and are using public/private key. Aug 20, 2018 at 17:43
  • 2
    This solved my issue, in some cloud server, after enable ssh login, password login is disabled automatically ...
    – Eric
    Jul 30, 2021 at 8:09
  • The OP didn't have this issue, but others who have a similar issue (e.g. yours truly) may be directed to this question by Google. I am trying to set up a test server within my firewall with password authentication. One might say that's never advisable, but I would like to know that I have the option.
    – Dr Phil
    Apr 25, 2023 at 2:38

I ran into this issue recently with my web server.

I typically keep a list of authorized keys on all my servers in ~/.ssh/authorized_keys2. From my experience, sshd will look for ~/.ssh/authorized_keys or ~/.ssh/authorized_keys2 by default.

In the case of my webserver, the /etc/ssh/sshd_config had this line

AuthorizedKeysFile    %h/.ssh/authorized_keys

instead of

AuthorizedKeysFile    %h/.ssh/authorized_keys2

I applied the latter, restarted my ssh daemon, and solved my problem logging in with ssh using my pubkey.

  • Thanks a lot, this helped me figuring out that this line was completely commented out of the config! Oct 8, 2018 at 8:45

Also make sure that the user's home directory (on the server) actually belongs to the user ssh'ing into (was set to root:root in my case).

Should have been:

sudo chown username:username /home/username;
  • I am able to ssh with public/private keys with a user on my local linux box (e.g. abc), different from the user on the remote server (e.g. [email protected]). I just had to make sure the local user owned the local .ssh files (e.g. abc:abc, not root:abc)` Dec 22, 2015 at 9:44

Another possible cause could be with the AllowedUsers configuration in /etc/ssh/sshd_conf. NOTE: the list is space delimited (not comma delimited) as I learned the hard way.

AllowUsers user1 user2 user3

The following method might work if you can access machineA and machineB independently (e.g. from machineC).

If ssh-copy-id is not working, password authentication could be disabled. The following is a workaround.

Having machineA's public key in machineB's authorized keys (i.e. ~/.ssh/authorized_keys) will allow you to ssh from machineA. This also applies to scp.

After generating the key pairs using: ssh-keygen

On machineA, execute cat ~/.ssh/id_rsa.pub

Sample output:

ssh-rsa AAAAB3NzaSGMFZW7yB anask@mahineA

Copy the printed key (⌘ Command+C, or CRTL+C) then add it to the ~/.ssh/authorized_keys file on machineB.

For example, execute the following on machineB:

echo 'ssh-rsa AAAAB3NzaSGMFZW7yB anask@mahineA' >> ~/.ssh/authorized_keys

  • This one worked for me- it turned out the simplest May 7, 2022 at 12:04

Works on Ubuntu 16.04 as well.

The issue is within sshd_config file

Here is the ULTIMATE solution:

Log as as a root to you Ubuntu server

vi /etc/ssh/sshd_config

Now go to very bottom and change the value from "no" to "yes".

It should look like this:

Change to no to disable tunnelled clear text passwords

PasswordAuthentication yes
service sshd reload

to take effect.

Now you can simply a key using following command from your LOCAL machine (aka laptop etc)

So in order to open a new terminal window and NOT log into server, simply use this command:

ssh-copy-id john@serverIPAddress

(Replace john with your username).

you should be good to go


I my case, the client is ubuntu 14.04lts, the server was win 2012 server running cygwin. I was using 'ssh [email protected]', when the 2012 server directory in cygwin was /home/Administrator. So it was case sensitive, when I tried 'ssh [email protected]' (note the capital A on Administrator) then it worked fine.

An error message like 'user not found' would have led me to the solution a lot quicker than 'Permission denied (publickey,keyboard-interactive)'.

  • Someone should log an issue with the ssh project suggesting that. I ran into a similar issue.
    – Ben Creasy
    Nov 27, 2016 at 11:58

I had the same issue when copying a regular user's (e.g. johndoe) public key from a cPanel Centos system over to an Ubuntu server on AWS. As suggested by gertvdijk above, I checked /var/log/auth.log and sure enough it said Authentication refused: bad ownership or modes for directory /home/johndoe. Turns out I had wrongly 777'ed /home/johndoe when trying to set /home/johndoe/public_html as the default virtualhost Document Root for apache2 (that's not needed for that task either).

See also the answers here and here

The server only needs to have the public key in .ssh/authorized_keys and the client (computer you're working on) needs to have the private key (.pem, or if using SFTP with Filezilla, .ppk)

  • Instead of 777, what should it be?
    – kurdtpage
    Apr 12, 2023 at 9:39

This is what worked for me, the fix is not mine but I would rather write it down here in case someone else has the same problem.

The original author posted it here: digital-ocean-public-access-key-denied

sudo nano /etc/ssh/sshd_config

Replace this

UsePAM yes
IgnoreUserKnownHosts no
PasswordAuthentication no

With this

UsePAM no
IgnoreUserKnownHosts no
PasswordAuthentication yes

Save the file and restart ssh

reload ssh

ssh should work now asking for a password

  • 2
    I wouldn't do that... Feb 17, 2021 at 10:57
  • 2
    PasswordAuthentication should remain no Mar 29, 2021 at 13:51

Some people wondering may have set up ssh access to be key only on the root account then created a new user and not realised they need to

ssh root@your-ip-address

rsync --archive --chown=[user]:[user] ~/.ssh /home/[user]


Then try again. Replace [user] with your new user account.

This is common when setting up a new server on DigitalOcean when you've used ssh-keys on setup.



If all else failed, check that your login user belongs to the ssh's AllowedGroup. That is, your users is a member of the group shown at the following line in /etc/ssh/sshd_config on the server:

AllowGroups ssh #Here only users of 'ssh' group can login

For those Putty users like me who came to this thread, you may also get this error if you forgot to add user user@Ip !

Others being permission on key file chmod to 600)

ssh -i /path/to/.pem file 
Permission denied (publickey).`

ssh [email protected] -i /path/to/.pem file 

I had the same problem as described in the question. The output from executing ssh -vvv -i id_rsa [youruser]@[yourLinode] on the client machine was similar to that described in the question. I checked all the file and directory permissions as advised in the other answers, and they were correct.

It turned out that when copying the generated file id_rsa.pub to the server machine, as file ~username/.ssh/authorized_keys, I'd accidentally omitted the word ssh-rsa from the start. Adding it solved the problem.


I had added a wrong key to the server. Because I did not use the command with an option to specify a certain key it added the standard key-file.

Make sure you did use ssh-copy-id -i CORRECT_KEY.pub

This wrong key worked great with one client, because this client also had this key. But when trying to connect with another client to the same server it obviously failed.

Also, which might be interesting is that you get more logging with ssh -vv instead of just the single -v.


Another causes for this error are:

  1. Incorrect user in ssh -i id_rsa [user]@[yourLinode]
  2. Outdated SSH RSA key. OpenSSH v8 deprecated RSA algorithm by default. Regenerate your keys with: ssh-keygen -t ed25519 -f ~/.ssh/your.key -C "My key"

This might be the case especially if you're getting the possible debug warning:

debug1: send_pubkey_test: no mutual signature algorithm

Here is the good article that describes possible issues for this error: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-fix-permission-denied-errors/

Other references:

  1. https://www.ssh.com/academy/ssh/keygen#ssh-keys-and-public-key-authentication
  2. https://confluence.atlassian.com/bitbucketserverkb/ssh-rsa-key-rejected-with-message-no-mutual-signature-algorithm-1026057701.html

Owner permission for the ~/.ssh directory, should contain your username.

chown -R $USER:$USER /home/$USER/.ssh

Note: Make sure $USER is your correct username (not root).


In my case the issue was caused by copying over an .ssh directory from an older machine. Turns out that my older SSH config was using DSA keys which have since been deprecated. Switching to a new pair of keys, this time RSA-based, solved the problem for me.


In general the quickest way to understand the reason of refused SSH connections is to inspect the SSH server log (assuming you can access the log without the tested SSH connection):

sudo systemctl status sshd

One possible reason is a move of the connecting client to a new subnet (ISP etc.) combined with a very restrictive filter set up in /etc/ssh/sshd_config, that requires not only a specific pre-defined user name, but also a connection from a pre-defined IPs range:

$ cat /etc/ssh/sshd_config | grep Users
AllowUsers <user>@

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .