Recommended Free Tools
“Permission denied (publickey)” means your VPS was reached, but its SSH server rejected the public-key identity offered for the account. The usual causes are a wrong username, the wrong private key, a missing or malformed line in authorized_keys, unsafe ownership or permissions, an sshd policy that does not read the key, or a local agent offering a different identity. Start with ssh -vvv user@server, then work through the account, key file, permissions, daemon policy, agent, and console-recovery checks below.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the error tells you
SSH has two broad phases: reaching the server and authenticating to an account. This message appears after the server has been contacted, so it is not the same as a DNS failure, a refused TCP connection, or a timeout. The server is saying that none of the public-key identities it could verify was accepted for the account you named.
As an Amazon Associate I earn from qualifying purchases.
The fastest way to see which identity is being tried is verbose client output:
ssh -vvv user@serverLook for lines showing the identity files the client offers, whether an agent is involved, and whether the server accepts or rejects each key. The additional -v levels increase diagnostic detail without changing the authentication policy.
Use the provider’s exact account name and private key
A key is valid only for the account whose authorized_keys file contains the matching public half. A correct key offered to the wrong account still fails because sshd looks in that other account’s home directory. VPS images do not all use the same initial username, so use the login name documented for your image and provider rather than assuming root, ubuntu, or another familiar name.
Select the intended key explicitly
Specify the private key with -i while troubleshooting:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →ssh -i ~/.ssh/id_ed25519 user@serverUse the private file on the computer from which you are connecting. The corresponding public key must be installed on the VPS. Selecting a different private key cannot work merely because another key pair exists on your computer or another public key is already present on the server.
Do not change account context accidentally
Running the client through sudo can switch to a different user’s home directory, SSH configuration, and agent. That often makes a working key appear to disappear. Run the command as the account that owns the intended private key, or give an explicit path to that key and inspect the resulting ssh -vvv output.
Confirm what the client actually offers
Run the verbose command with the same username, host, and key you normally use:
ssh -vvv -i ~/.ssh/id_ed25519 user@serverUse the output to answer three questions:
- Is the expected private-key file found and offered?
- Is an SSH agent offering other identities first, or reporting a signing failure?
- Does the server reject the offered public key, or does the client never offer it?
If the expected file is not offered, correct the path, file access, or account context before changing the server. If the key is offered and rejected, move to the VPS-side checks.
Free tools Windows power users keep installed
One-click scans. No signup required.
Verify the public key on the VPS
The public half of the pair must appear in the target account’s configured AuthorizedKeysFile. OpenSSH’s normal locations are ~/.ssh/authorized_keys and, on configurations that retain the older default, ~/.ssh/authorized_keys2; an sshd_config setting can point elsewhere.
Check the complete line
From an existing administrative session or the provider console, open the file for the target account and confirm that the public key is present as one complete line. A key copied with a line break in the middle is not the same key. Preserve the key type, the long base64 section, and any optional comment exactly as generated. Do not paste the private key into the server.
Compare the pair without exposing the private key
On the client, the public key is normally next to the private key, for example ~/.ssh/id_ed25519.pub. Compare that public line with the line in the server’s authorized-key file. If the files differ, install the public line for the intended account through the provider’s console or another administrative login, then retry with the matching private key.
Repair home-directory, ownership, and file permissions
OpenSSH can reject a key when the account’s home directory or SSH files are writable by the wrong users, or when another owner controls them. Check every path component from the home directory down to authorized_keys. The exact home-directory mode can vary by distribution and image, but the target account must own its home and SSH files.
Apply the documented baseline modes
When operating as the target user, Ubuntu’s documented example is:
chmod go-w ~/
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keysThe first command removes group and other write permission from the home directory. The second restricts the .ssh directory to its owner. The third restricts the authorized-key file to its owner. If you are in a root console, do not use an unqualified ~ unless you have switched to the target account; root’s home directory is different. Use the account’s actual home path instead.
Correct ownership as well as modes
Ensure the home directory, .ssh, and authorized_keys are owned by the intended login account. A representative command, adapted to the real account and home path, is:
chown user:user /home/user/.ssh /home/user/.ssh/authorized_keysAlso check the home directory itself and any parent path that prevents the account from traversing to the file. Do not blindly apply a recursive ownership change to an entire home directory if it contains files that intentionally belong to another service; correct the account and SSH paths specifically.
Inspect the effective sshd policy
Even a correct key in a correctly protected file is useless if the daemon is not configured to use public-key authentication or is reading a different file.
Confirm public-key authentication is enabled
Review the effective SSH server configuration and its included files. Public-key authentication is one of the daemon’s authentication methods; a distribution or hardening file can override a setting you edited elsewhere. Confirm that public-key authentication has not been disabled and that account restrictions do not exclude the target user.
Confirm AuthorizedKeysFile
Find the active AuthorizedKeysFile setting and compare it with the location where you installed the public key. If the setting names a custom path, place the key there with the same ownership and permissions rather than assuming ~/.ssh/authorized_keys is active. Review configuration fragments included by the main file, because an included fragment can override a value that looks correct in the file you first opened.
Validate before restarting
Use the configuration-test command supplied by your distribution before restarting the daemon; on systems that provide the standard OpenSSH utility this is commonly:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →sshd -tRun the provider- or distribution-documented equivalent when the command differs. Fix syntax errors before restarting. If you still have one working SSH session, keep it open while testing and restarting so a bad change does not remove your last remote route.
Repair a local SSH-agent problem
The verbose output may show that the agent cannot sign with the selected identity, or that the expected key is not loaded. Load the private key into the agent explicitly:
ssh-add ~/.ssh/id_ed25519Retry with ssh -vvv and verify that the expected identity is offered. If the command is run under another user, that user may have a different agent socket and key list. Keep the account context consistent from ssh-add through the final SSH attempt.
Recover access when every SSH attempt is rejected
If no SSH session remains, use the VPS provider’s out-of-band route: a web console, serial console, or maintenance console. The labels and login procedure differ by provider and image, so follow that provider’s supported administrative route rather than assuming a universal console username.
- Open the provider’s web, serial, or maintenance console and authenticate through its supported administrative method.
- Identify the target account and its real home directory.
- Inspect the configured
AuthorizedKeysFileand restore the complete public-key line for that account. - Repair ownership and the home,
.ssh, andauthorized_keyspermissions. - Review the effective
sshdpolicy and included configuration files. - Run the distribution’s configuration test, such as
sshd -twhere available. - Restart SSH only after validation, then test from a separate client using
ssh -vvv.
Serial-console and maintenance-mode recovery are particularly useful when a permissions or configuration change has locked out every network login. Treat the console as a repair path, not a reason to weaken SSH permanently.
Choose the fix by where the failure occurs
| Observed fault | Access needed | Typical corrective action | Security and reversibility |
|---|---|---|---|
| Wrong username or private key selected | Client access only | Use the provider’s account name and select the matching private key with -i. |
Highly reversible; changes only the client command. |
| Expected identity is not offered or the agent reports a signing failure | Client access only | Load the intended key with ssh-add, avoid an unintended sudo context, and recheck verbose output. |
Reversible; does not alter server key material. |
| Public key missing, wrapped, or installed for another account | Existing administrative SSH session or provider console | Place the complete public-key line in the target account’s active AuthorizedKeysFile. |
Limited change; preserves the existing key pair. |
Home, .ssh, or authorized_keys ownership or modes are unsafe |
Existing administrative SSH session or provider console | Set ownership to the intended account and apply the documented restrictive modes. | Reversible and generally lower risk than changing authentication policy. |
| Public-key authentication disabled or key path overridden | Existing administrative SSH session or provider console | Correct the effective daemon policy and included files, validate the configuration, then restart. | Configuration change; validate before restart and retain a working session. |
| No SSH route remains | Provider web, serial, or maintenance console | Repair the key file, permissions, and daemon policy out of band, then test remotely. | Recovery access is provider-specific; avoid broad permanent policy changes. |
Common traps that make the problem persist
Assuming the default username
Cloud images use different initial accounts. A valid key in /home/one-user/.ssh/authorized_keys will not authenticate a login as another user whose home directory and key file are different.
Installing the public key but using another private key
The server stores only the public half. The client must possess and offer the matching private half. Replacing or regenerating a key is unnecessary until you establish that the current pair does not match.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Editing the wrong authorized-key file
A custom AuthorizedKeysFile setting or an included configuration fragment can direct sshd elsewhere. Always check the effective policy before concluding that the server ignored a correctly copied key.
Running permission commands for the wrong account
Using sudo or a root console while relying on ~ can modify root’s home instead of the target user’s. Resolve the target account and explicit home path first.
Restarting before testing
A syntax error or unintended include can make the daemon fail to reload. Validate the configuration first, and keep an existing SSH session open until a new login has succeeded.
Keep a recoverable SSH setup
- Keep a second tested administrative key so one damaged key file or lost laptop does not remove your only login path.
- Verify that the provider’s web, serial, or maintenance console works before making SSH-only changes.
- When a console recovery temporarily changes password or root-login policy, limit the change to the recovery window, validate the daemon, test the repaired key, and restore the hardened setting immediately.
- Do not broadly enable password authentication or permanent root login as a shortcut for a public-key failure.
- Record the provider-specific username, home path, console method, and active
AuthorizedKeysFilefor each VPS.
A compact diagnostic checklist
- Run
ssh -vvv user@serverand identify the offered identities and server responses. - Retry with the provider’s exact username and
ssh -i ~/.ssh/id_ed25519 user@server. - Confirm the matching public key is one complete line in the target account’s active authorized-key file.
- Check ownership and apply
chmod go-w ~/,chmod 700 ~/.ssh, andchmod 600 ~/.ssh/authorized_keysin the correct account context. - Inspect public-key authentication,
AuthorizedKeysFile, included files, and account restrictions. - If the agent is involved, run
ssh-add ~/.ssh/id_ed25519and repeat the verbose test. - If locked out, use the provider console to repair the account, key file, permissions, and daemon configuration; validate before restarting.
Frequently Asked Questions
Will generating a new SSH key automatically fix “Permission denied (publickey)”?
No. A new pair helps only when the existing private and public keys no longer match or the old key is unavailable. First use verbose output to verify the account and identity, then install the new public key deliberately for the target account.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsCan I put the key in authorized_keys2 instead of authorized_keys?
Only if the server’s effective AuthorizedKeysFile setting includes that path. OpenSSH documents both names as defaults in some configurations, but an explicit setting or included file can choose a different location.
Why does SSH work normally but fail when I prefix the command with sudo?
sudo can switch the client to another user’s home directory, key files, and agent. Run the SSH command in the account context that owns the intended private key, or specify that key explicitly and inspect ssh -vvv.
What should I do if the provider console also rejects my login?
Use the provider-supported administrative or maintenance procedure for that VPS image. Console authentication and usernames are provider-specific; once access is restored, repair the target account’s key file and permissions before changing remote SSH policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
