Free tools Windows power users keep installed
One-click scans. No signup required.
“Access denied” means your connection reached an SSH service, but every authentication method the client tried was rejected. It does not, by itself, prove that your password is wrong, that PuTTY or WinSCP is defective, or that a firewall is blocking you. The cause can be a wrong VPS username, a key in the wrong format, an unintended Pageant or ssh-agent key, a missing or incorrectly protected authorized_keys file, or a server policy that disables the account or login method.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Use the sequence below. First separate authentication failures from network failures, then verify the session fields, test from the VPS provider’s console, and change one variable at a time while reading the server’s authentication log.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What “Access denied” actually tells you
PuTTY’s manual describes the message precisely: “This error indicates that PuTTY has run out of ways to authenticate you to an SSH server.” In practical terms, the TCP connection and SSH negotiation got far enough for the server to request credentials. The server then refused the password, public key, keyboard-interactive response, or other methods offered by the client.
WinSCP can try several methods in sequence, including GSSAPI, a public key supplied by Pageant, a configured private key, keyboard-interactive authentication, and a password. A stale agent key, an expired account, or a rejected key can therefore look identical to a mistyped password. The visible message is a symptom, not a diagnosis.
Classify the symptom before changing credentials
The wording and timing tell you which layer to investigate first.
| What you see | Where the failure occurs | First checks |
|---|---|---|
| “Access denied,” “Authentication refused,” or “Server refused our key” | SSH authentication | Username, permitted login methods, password or key, agent, account status, and server logs |
| “Too many authentication failures” | Authentication, after too many offered credentials | Disable Pageant/ssh-agent temporarily or load only the key for this VPS |
| Connection timeout | Network reachability or a silently dropped connection | VPS availability, destination port, local and server firewalls, proxy, and routing |
| Connection refused | The address is reachable, but no service is accepting that port | SSH service status, configured port, protocol, and provider firewall |
| FTP or FTPS negotiation errors | Protocol mismatch | Select SSH/SFTP or SCP, not FTP/FTPS |
A firewall can cause a timeout or refusal, but it normally does not create an SSH authentication denial after the server has asked for a login. If a browser console can reach the VPS while PuTTY or WinSCP receives “Access denied,” focus on identity and account policy first.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchVerify the session fields exactly
Use the VPS address and SSH protocol
In PuTTY, choose the SSH connection type and enter the VPS hostname or IP address. In WinSCP, choose SFTP (or SCP when your server is configured for it), not FTP or FTPS. SSH uses port 22 by default, but a provider or administrator may have changed it. Enter the documented SSH port exactly; a web-panel port or an unrelated application port will not work.
Use the operating-system account name
The login name is the account inside the VPS image, not necessarily the email address or username used for the hosting control panel. Common images create a distribution-specific administrator account and may disable direct root login. If you are unsure, open the provider’s browser or serial console and list the intended account there. A correct password paired with the wrong account is still rejected.
Check for hidden client substitutions
Review saved sessions before retrying. Confirm that the hostname, port, username, protocol, proxy setting, and selected key belong to the same VPS. A saved session can silently retain an old port or username. In WinSCP, the site’s Advanced Site Settings > SSH > Authentication page controls the private key, agent use, and keyboard-interactive behavior. In PuTTY, the corresponding settings are under Connection > SSH > Auth.
Use the provider console to separate network and account problems
A browser-based or serial VPS console does not depend on your local SSH client. If the console opens, the VPS is running and you can inspect the account and SSH service from inside the machine. If the console itself is unavailable, resolve the VPS state or provider-side access issue before debugging PuTTY or WinSCP.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
From the console, check all of the following, using the commands and service names appropriate to your distribution:
- Whether the SSH daemon is running and listening on the expected port.
- The authentication log entry generated at the exact time of a failed attempt.
- Whether the target account exists, is locked or expired, and has a valid login shell.
- Whether SSH configuration restricts the account with
AllowUsers,DenyUsers, group rules, or a provider-specific policy. - Whether password authentication, public-key authentication, or root login is disabled.
Do not treat one command as universal. Service names, log locations, and account-management tools differ among Linux distributions and provider images. The log’s reason—such as an invalid user, refused key, locked account, or disabled method—is more valuable than repeatedly entering the same credential.
Fix password authentication failures
Enter the VPS account password, not the panel password
Type the password assigned to the operating-system account. Hosting-panel credentials and VPS user credentials may be unrelated. Check Caps Lock and the keyboard layout, especially when the password contains symbols that move between layouts. SSH does not echo password characters, so the absence of visible feedback is normal.
Confirm that the image permits passwords
Many hardened VPS images disable SSH password authentication and require a public key. In that configuration, a password can be completely correct and still be rejected. The SSH configuration and the server log reveal whether password authentication is disabled. Do not enable it merely to bypass a key problem unless you understand the exposure and have a recovery plan.
Check account state and policy
An expired or disabled password, a locked account, an invalid shell, or an SSH user restriction produces the same client-facing denial. Use the console to verify the account’s status and to inspect the policy that applies to it. If root login is disabled, log in with the image’s regular administrator account and use the permitted elevation method from inside the VPS.
Fix public-key login in PuTTY and WinSCP
Select the private key that matches the server
In PuTTY, open Connection > SSH > Auth and select the private key for the target VPS. In WinSCP, open Advanced Site Settings > SSH > Authentication and set the private-key file there. Make sure the key belongs to this server and account; selecting a different customer’s key will correctly result in rejection.
Use the format the client expects
PuTTY and WinSCP commonly use PuTTY’s .ppk private-key format for direct selection. OpenSSH and ssh.com private keys use different encodings. WinSCP can convert those formats, and it can also use keys supplied by Pageant or an OpenSSH-compatible ssh-agent. If a key is not accepted by the file picker or fails immediately, convert it with the client’s key-conversion workflow or select the already-converted .ppk file.
Never replace a private key with a public-key file. The client needs the private half; the server stores the corresponding public line. Keep the private file protected and do not paste it into a ticket, chat, or server configuration.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsPlace the public key in the correct account
The public key must be present in the target account’s .ssh/authorized_keys file. A key installed for one account does not authorize a different account. From the VPS console, verify the account’s home directory and confirm that the public-key line is intact on one line; wrapping it across lines or adding unrelated characters makes it invalid.
Ownership and permissions matter. The .ssh directory and its files should be owned by the login account rather than by an administrator account, and the directory should not be writable by other users. WinSCP’s public-key guidance specifically recommends mode 600 for authorized_keys. A typical repair, adjusted for your distribution and username, is:
chmod 700 /home/USER/.ssh
chmod 600 /home/USER/.ssh/authorized_keys
chown -R USER:USER /home/USER/.sshReplace USER and the path with the actual account and home directory. Some systems use a different home path or group name. If the server still refuses the key, read the authentication log; it will usually identify a wrong path, ownership problem, malformed key, or policy restriction.
Control Pageant and ssh-agent
Agents are convenient but can obscure which credential is being offered. WinSCP’s authentication order can include a public key from Pageant before the configured key. If the agent contains several unrelated keys, the server may reject enough offers to trigger “Too many authentication failures” before the correct key is tried.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #4
- Standard size: 4 pink server note pads, Each Book Comes with 50 bound order slips - that's 200 ticket sheets total! Check Pads Size 6.75 x 3.5 inch.
- Convenient Work: These guest check books for servers have a tear-free dotted line that is easy to rip off. You can give as a customer copy or keep for record keeping. We've provided extra rows on the back for additional note taking.Perfect For Restaurants, Lounges, Hotels, Cafes, And Waiters To Use.
- Record Important Information: These server note pads can record important information.Each ticket has a unique serial number printed at the top, dates, order details, number of guests, order amount, table numbers etc. They are lightweight, small and can fit most aprons. They can be used on-demand and can help decrease errors in orders, while improving work efficiency.
- High Quality: Sturdy, Not Drop Powder, It's Thick, You Can Write On The Back And Front Easily.Their whole page printing has clear handwriting and a reasonable layout. On the customer retention part of each guest check, "THANK YOU" on the back to make customers feel appreciated.
- Contact Us: We're confident that the quality of the server note pads will go beyond your expectation. If you experience an issue, contact us, we'll appreciate it to learn from your experience, and we'll make it better
- Temporarily disable agent use in the session’s SSH authentication settings, then retry with only the selected private-key file.
- If the direct key works, clear the agent and load only the key for this VPS.
- Retry the original session with agent use enabled only after confirming that the intended key is offered first.
This test changes one variable—the source of the key—without changing the host, port, username, or server policy. If disabling the agent fixes the login, the VPS and key pair were probably sound; the unintended offers were the problem.
Check server-side SSH policy and logs
When the username and key or password are correct, the server can still deny access by policy. Inspect the SSH daemon configuration and the account’s status from the VPS console. Relevant conditions include:
AllowUsers,DenyUsers, group restrictions, or provider-level access controls.- Password authentication disabled while the client is trying a password.
- Public-key authentication disabled or restricted to a different file.
- Direct root login disabled.
- An expired password, locked account, or invalid login shell.
- A mandatory keyboard-interactive or multi-factor method that the client is not completing.
Read the authentication log immediately after one failed attempt. Distribution-specific tools may expose it through a system journal or a traditional authentication-log file. Record the exact message before editing configuration. Broad changes can hide the original cause and may lock you out if the console session is closed.
Investigate ports, proxies, and firewalls only for network symptoms
If the client times out or reports connection refused, verify that the VPS is powered on, the SSH daemon is listening, and the configured port matches the provider’s documentation. Check the VPS firewall and any upstream security-group rule, then check the local network and proxy. A proxy omitted from one client can make PuTTY and WinSCP behave differently even when the VPS is healthy.
Local security software can also distinguish applications. WinSCP notes that a newly upgraded executable may be blocked even when an older version has an existing firewall exception. If one client connects while another times out, inspect per-application rules and create a rule for the current executable rather than weakening the entire firewall.
Do not start by opening additional ports when the message is an authentication denial. Port changes cannot repair a rejected password or key, and unnecessary exposure makes later hardening harder.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Retest with one known-good variable at a time
- Write down the VPS host, SSH port, protocol, username, and intended authentication method.
- Use the provider console to confirm the account, SSH service, and latest log message.
- In one client, keep the host, port, username, and protocol fixed.
- For a password test, disable key and agent use if the client allows it, then enter the VPS account password once.
- For a key test, disable the agent, select the matching private key, and retry once.
- Compare the new server-log entry with the previous one.
- Change only the variable named by the log—such as the account, key file, permission, or authentication policy—and retest.
Keeping a short record prevents a common failure mode: changing the port, username, key, and firewall simultaneously, then losing the evidence needed to identify the real fault.
Password versus public-key login
| Decision point | Password login | Public-key login |
|---|---|---|
| VPS image support | May be disabled by hardened images or SSH policy. | Usually enabled when the image is provisioned with an SSH key, but still subject to server policy. |
| Recovery when access is lost | Reset the account password from the provider console, if the provider permits it. | Use the console to install the matching public key in the correct account’s authorized_keys file. |
| Client complexity | Check username, password, layout, and account status. | Check key pair, file format, agent selection, server placement, ownership, and permissions. |
| Auditability | Users share a secret that can be changed or rotated. | Separate keys can identify administrators and be removed individually. |
| Brute-force exposure | A network-reachable password prompt is exposed to password-guessing attempts; strong passwords and rate controls are important. | The private key must remain protected, while the server can reject password authentication entirely when policy allows. |
For a production VPS, choose the method your image and organization support consistently, keep a console recovery path, and document how credentials are rotated. Do not enable a weaker method temporarily without recording how and when it will be disabled.
PuTTY and WinSCP: different jobs, same SSH policy
| Client | Best suited to | Authentication considerations |
|---|---|---|
| PuTTY | Interactive terminal administration and command-line work. | Set the private key under Connection > SSH > Auth; an agent can supply other keys unless controlled. |
| WinSCP | SFTP or SCP file transfer with a graphical interface. | Set the key under Advanced Site Settings > SSH > Authentication; it can convert key formats and use Pageant or OpenSSH-compatible agents. |
Choosing a different client does not bypass the VPS’s SSH rules. Both clients ultimately present credentials to the same server, so a disabled account, missing public key, or prohibited authentication method will affect both. A difference between clients usually comes from their saved session fields, key format, agent behavior, proxy, or local firewall rule.
Targeted fixes for common combinations
The provider console works, but both clients say “Access denied”
Use the console to identify the account and read the authentication log. Verify whether the image permits password login or requires a key, then repair the account policy or the key placement. This pattern points to credentials or server policy rather than basic network reachability.
One client works and the other fails
Compare the working and failing sessions field by field: protocol, port, username, proxy, selected key, and agent setting. If the failing client times out, inspect its local firewall or proxy. If it receives an authentication denial, inspect its key format and agent order.
The log says the key was refused
Confirm that the public half of that exact key is in the target account’s authorized_keys, on one intact line, with account ownership and restrictive permissions. Then confirm that the client is selecting the matching private half rather than an older key with a similar filename.
The log says the user is invalid or not allowed
Correct the username or the server’s user restriction from the console. If the provider image disables root login, use its designated administrator account instead of repeatedly trying root.
The client reports too many authentication failures
Stop offering agent keys, load only the intended key, and retry. Do not keep reconnecting with a large agent key list; the server may disconnect before reaching the correct credential.
Keep a recovery path after the login is fixed
- Leave the provider console enabled and verify that you can open it before ending your maintenance session.
- Store an offline copy of the private key securely and record which account and VPS it authorizes.
- Keep a second, tested administrative key or another documented recovery method where policy permits.
- Remove obsolete public keys from
authorized_keysand clear old keys from Pageant or ssh-agent. - Document the SSH port, permitted usernames, and whether password authentication is intentionally disabled.
- After changing SSH policy, open a second test session before closing the working one.
These steps turn a future “Access denied” incident into a controlled recovery rather than a blind sequence of password and key changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
