PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match“Permission denied” in SFTP is not one problem. It can mean the server rejected your key, the SFTP service refused to start for your account, or the account you logged in as cannot touch one particular path. Find out which stage failed before you change any permissions. A permission change aimed at the wrong stage will not fix anything, and it can open access you never meant to grant.
Start by preserving the exact error
The full message and the path inside it tell you which stage failed. Capture them before you touch the server.
As an Amazon Associate I earn from qualifying purchases.
- Copy the complete error line, including the path and any parenthetical such as
(publickey). A shortened version like “permission denied” loses the detail you need. - Reproduce the failure with verbose output. For an interactive client, run
sftp -v user@host, and add morevflags (up to-vvv) if the first pass is not specific enough. - Note the operation that failed: connecting, listing, creating a file, writing, closing, or renaming. The client usually prints a remote operation name such as
remote openbeside the path. - Record the account name you logged in with (
user@host), the time of the attempt, and the host. You will need these to match server log entries later.
Identify the failing stage
An SFTP session passes through three layers, each with its own access rules: the SSH login, the start of the SFTP subsystem, and then each individual file operation. The table below maps common symptoms to the layer they indicate.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors| Symptom | Failing stage | Where to look first |
|---|---|---|
Permission denied (publickey) before any sftp> prompt |
Authentication | Client verbose output, the key being offered, and the account’s authorized keys on the server |
| Denial naming a path during open, create, write, or close | File operation in an authenticated session | Ownership and mode of the target directory and each parent, mount state, and quota |
| Normal SSH shell login works, but SFTP fails or closes immediately | SFTP subsystem startup | Subsystem, Match, ForceCommand, and ChrootDirectory settings; server authentication log |
| A folder can be listed but files cannot be uploaded into it | File operation (write permission missing) | Write and search permission on that directory for the logged-in account |
| Failure on a cloud-managed SFTP endpoint | Provider access policy | The provider’s own identity, bucket, or storage access documentation |
The last row is the one most often misdiagnosed. On a managed endpoint, Unix ownership and chmod may have no bearing on what you are allowed to do, so start with the provider’s documentation rather than the remote filesystem.
Authentication failures: Permission denied (publickey)
This message means the server did not accept any offered key for the account. Nothing has been checked against a file yet, so changing remote directory permissions will not help.
Confirm which key the client offers
Run ssh -v user@host and look for lines beginning with Offering public key. These show each identity the client tries. If the key you expect is missing, the client is not using it: add it with ssh-add, or name it explicitly with -i /path/to/private_key. Confirm that the host name and user name in the output match what you intended.
Check the matching public key on the server
The public half of the key must appear in the target account’s ~/.ssh/authorized_keys. Confirm that the entry was pasted as a single line and was not truncated or wrapped. Confirm also that the account on the server is the one you logged in as, since a key authorized for one user does not work for another.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check the permissions that sshd enforces
OpenSSH’s StrictModes setting, which is on by default, makes sshd refuse keys when the home directory, ~/.ssh, or authorized_keys are writable by other users. The usual safe layout is a home directory and ~/.ssh that only the owner can write, and an authorized_keys file readable only by its owner. On the client, the private key file should likewise be readable only by you. If sshd is logging a permission complaint, the auth log will name the file.
Watch for a different identity
If you start the client with sudo or from an elevated shell, it reads the keys of that environment’s account, usually root, not yours. GitHub’s SSH troubleshooting guidance makes the same point for its own service. That article is specific to GitHub accounts, but the general lesson applies to any SSH server.
Windows OpenSSH
On Windows, the authorized-key location depends on the account. Microsoft Learn documents a separate file, administrators_authorized_keys, for accounts in the Administrators group, and it requires restrictive ACLs on that file. Ordinary users use their own profile’s authorized_keys. Do not copy a Windows ACL command onto a Unix host, and do not assume every Windows user is handled by the administrators’ file.
File-operation failures on a named path
If the message names a path during open, create, write, or close, the session authenticated successfully. The server rejected the operation, so the question is what the logged-in account can actually do to that path.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- Check the account. Run
idon the server, or confirm the user name in the failing session, to see the account and its groups. - Trace every component of the path. Run
namei -l /remote/path(util-linux). It prints owner, group, and mode for each component, so you can see if a parent directory blocks access even when the target looks fine. - Verify the access bits you need. Creating or writing a file in a directory requires write and search (execute) permission on that directory for the account. A directory can be readable and listable yet still refuse uploads, which is the most common “I can see it but cannot save to it” case.
- Check whether the destination is inside the account’s visible tree. On a chrooted or jailed account, a path that exists on the server may be outside what the account can reach at all.
- Check the mount and capacity.
findmnt -T /remote/pathshows the filesystem holding the path and whether it is mounted read-only.df -h /remote/pathshows free space. If user quotas are enabled,quota -sshows the account’s usage.
When ownership and mode are correct and the mount is writable, the remaining cause is usually a quota or capacity limit, or a service account that owns the directory and is not the one you are logged in as.
Prefer a narrow fix. Give the transfer account or a group write access to one upload directory, rather than widening access to a whole tree. Identify the owner, the filesystem, and the access policy before you run any recursive ownership or mode change.
OpenSSH chrooted accounts
The OpenBSD sshd_config(5) manual, in its description of ChrootDirectory, states the rule that most often causes chrooted uploads to fail:
“At session startup sshd checks that all components of the pathname are root-owned directories which are not writable by group or others.”
In practice, every directory from / down to the chroot directory must be owned by root and must not be writable by group or others. If that condition fails, sshd refuses the session at startup, and the client typically reports a generic failure rather than the path rule itself. The server’s authentication log names the real cause, so read it before changing anything.
The working pattern keeps the chroot root locked and places a writable transfer directory inside it. Here is an example layout with a per-user match block:
Subsystem sftp internal-sftp
Match User alice
ChrootDirectory /srv/sftp/alice
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no
Under that layout, /srv/sftp and /srv/sftp/alice stay root-owned and not writable by group or others, and only a subdirectory such as /srv/sftp/alice/upload is owned by the transfer account. Making the chroot root itself writable to allow uploads is the mistake this rule exists to prevent.
The internal-sftp option runs the SFTP server inside sshd rather than launching a separate binary, which simplifies chrooted setups because no helper program has to exist inside the jail. Validate changes before reloading. sudo sshd -t checks syntax, and sudo sshd -T -C user=alice prints the effective settings for that user, so you can confirm the Match block applies. The service name for reloading varies by distribution, commonly sshd or ssh.
SSH login works but SFTP fails at startup
If a normal shell login succeeds and SFTP still fails or closes at once, the problem lies in how the SFTP subsystem is started for that account. Check the following in order:
- The
Subsystemline.sshd -Tshows the effective value. A missing or misspelled subsystem entry stops SFTP even though SSH works. - Any
Matchblock for the user or group. AForceCommandorChrootDirectoryrule applies only to matching sessions, so a shell-only restriction can silently break SFTP. - The server authentication log. Locations vary by distribution and logging setup. Common places are
journalctl -u sshdon systemd systems,/var/log/auth.logon Debian-based systems, and/var/log/secureon Red Hat-based systems. Search for the account name and the time of the failed attempt. - The chroot path rule. If a chroot is configured, apply the ownership and mode check described above before anything else.
Unusual case: moves across filesystems
SSHFS, the FUSE client that mounts a remote directory locally, documents that a rename across remote filesystem boundaries can be reported as permission denied. The cause is the rename operation itself, not necessarily the account’s permission on either directory. Treat this as an operation-specific behaviour of SSHFS. Do not assume it applies to ordinary uploads, which fail for the reasons covered above.
What not to do
- Do not run
chmod 777. It makes a path writable by every local account and removes any protection the mode provided. On a chrooted server, it also violates the ownership and mode rule and will keep sshd from starting the session. - Do not change ownership recursively as a first step. Identify the owner, the filesystem, and the intended access policy first.
- Do not make the chroot root writable. Create a writable subdirectory inside it instead.
- Do not disable
StrictModesto get a key accepted. The check is protecting the key file from tampering.
Checklist before you change permissions
- The exact error line, with its path and operation name, is saved.
- The failing stage is identified: authentication, SFTP startup, or a named file operation.
- The offered key and target account were confirmed with verbose output.
- Every component of the path was inspected, and the logged-in account matches the owner or group you expect.
- For chrooted accounts, the chroot path rule was verified and the writable directory sits inside the jail.
- The server authentication log was read for the precise server-side cause.
Source notes: the OpenSSH behaviour above follows the OpenBSD sshd_config(5) manual, and the installed OpenSSH version can differ, so check sshd -V or your distribution’s documentation. Windows guidance follows Microsoft Learn’s OpenSSH documentation. The SFTP troubleshooting classification draws on a guide from SSHFlow dated September 7, 2026. Commands and log paths are standard on common Linux systems but are not universal.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
