SSH Permission Denied: The Six Things to Check First

SSH permission denied is one of the most common SSH errors. Six things to check: the key, the permissions, the user, the authorized_keys, the SSH config, the security group. The fix is usually in the first three.

Table of contents

• Check the key
• Check the permissions
• Check the user
• Check the authorized_keys
• Check the SSH config
• Check the security group
• FAQ

Check the key

The first thing to check: does the private key match the public key on the server?

The flow:

• The team generates a key pair on the client.
• The team copies the public key to the server.
• The team logs in: ssh user@server.

The fix: if the public key on the server does not match the private key on the client, the team regenerates the key pair and copies the new public key to the server.

Check the permissions

The second thing to check: are the file permissions correct?

The flow:

• The private key on the client should be chmod 600 (read/write for the owner only).
• The ~/.ssh directory on the client should be chmod 700 (read/write/execute for the owner only).
• The ~/.ssh/authorized_keys file on the server should be chmod 600 (read/write for the owner only).
• The ~/.ssh directory on the server should be chmod 700 (read/write/execute for the owner only).

The fix: if the permissions are wrong, the team resets them. The SSH server is strict about the permissions; the wrong permissions cause the public key to be rejected.

Check the user

The third thing to check: is the user correct?

The flow:

• The user on the client is the user that is logged in.
• The user on the server is the user that the SSH server is trying to log in as.
• The public key on the server is in the ~/.ssh/authorized_keys of the user on the server.

The fix: if the user is wrong (e.g., the team is trying to log in as root but the public key is in the ubuntu user’s authorized_keys), the team logs in as the correct user.

Check the authorized_keys

The fourth thing to check: is the public key in the ~/.ssh/authorized_keys of the user?

The fix: if the public key is not in the ~/.ssh/authorized_keys, the team copies it. The command: ssh-copy-id user@server.

Check the SSH config

The fifth thing to check: is the SSH config correct?

The flow:

• The SSH config on the client (~/.ssh/config) can override the default SSH behavior.
• The SSH config on the server (/etc/ssh/sshd_config) can restrict the SSH behavior.

The fix: if the SSH config is wrong, the team corrects it. The most common issue: the SSH config specifies a different username, a different port, or a different key file.

Check the security group

The sixth thing to check: is the security group allowing the SSH traffic?

The flow:

• The SSH server listens on port 22 (or a different port).
• The security group on the server (or the firewall) must allow the SSH traffic from the client.

The fix: if the security group is blocking the SSH traffic, the team adds a rule to allow it. The rule should be as restrictive as possible (only the team’s IP, only the SSH port).

FAQ

Why is SSH permission denied?

Six common causes: the key does not match, the file permissions are wrong, the user is wrong, the authorized_keys is missing the key, the SSH config is wrong, the security group is blocking the SSH traffic.

How do I fix SSH permission denied (publickey)?

Check the key, the permissions, the user, the authorized_keys, the SSH config, the security group. The fix is usually in the first three.

What is the right permission for the SSH private key?

chmod 600. Read/write for the owner only. The SSH server is strict about the permissions; the wrong permissions cause the public key to be rejected.

What is the right permission for the SSH authorized_keys?

chmod 600. Read/write for the owner only. The SSH server is strict about the permissions.

How do I copy the SSH public key to the server?

ssh-copy-id user@server. The command copies the public key from the client to the ~/.ssh/authorized_keys of the user on the server.

How do I check the SSH config on the server?

cat /etc/ssh/sshd_config shows the server config. The most common issue: the PasswordAuthentication is set to no, the PubkeyAuthentication is set to no, or the AuthorizedKeysFile is set to a non-default path.

If you are sizing a server tier for a new project, the RunxBuild hosting calculator is the place to model the line items. The instances, the SSH keys, the storage, the network - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual SSH sessions in one place.