Recommended Free Tools
If SSH returns Permission denied (publickey)., check the destination and login account first, then confirm which private key your client offered. Next verify that the matching public key is installed for that account and that the server accepts the key file’s ownership and permissions. Client debug output and server authentication logs help separate these causes.
Why does SSH say “Permission denied (publickey)”?
SSH public-key login uses a pair: the client proves it has the private key, and the server checks whether the corresponding public key is authorized for the account you named. The private key stays on the client; install or copy only the public key. Ubuntu’s server guide documents this setup and the user-specific authorized-key workflow: Ubuntu Server: OpenSSH server.
As an Amazon Associate I earn from qualifying purchases.
The message means public-key authentication did not establish access. It does not, by itself, identify whether the client offered the wrong identity, the server could not find or accept the matching public key, or a configuration or permission rule intervened. A subsequent password prompt also does not prove the key is invalid: first determine whether the intended key was offered and how the server handled it.
VPS and VDS labels do not determine SSH behavior. The operating-system image, OpenSSH build and configuration, account, network reachability, and provider setup are the relevant variables. The Ubuntu examples below apply to Ubuntu; other images may use different paths, service names, defaults, or recovery tools.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should you check first?
- Confirm the destination and account. Check the hostname or IP address, port, and username. A public key installed for one user does not authorize a different account by default.
- Check the offered identity. Run SSH with verbose output, for example
ssh -v user@server. If needed, add anotherv(for example,-vv) for more detail. Look for which identities the client tries and whether authentication proceeds with the intended key. These flags increase client-side diagnostic detail; they do not change server authorization. - Check that the private key is available and unlocked. If it has a passphrase, enter it when prompted. If you rely on an SSH agent, check whether the intended identity is loaded. Ubuntu’s guide explains passphrases and agent use; its community troubleshooting page includes
ssh-addas an agent diagnostic: Ubuntu Community Help Wiki: SSH/OpenSSH/Keys. - Check the public-key installation for that account. On Ubuntu,
ssh-copy-id username@target_machineis the documented way to install a public key for a remote user. Confirm the server account’s authorized-key file contains the public key matching the private identity offered by the client. - Inspect ownership and permissions along the path. Check the account’s home directory, its
.sshdirectory, and the authorized-key file. Correct the specific ownership or write-permission issue you find; do not loosen permissions as a shortcut. - Check effective server settings and logs. Confirm public-key authentication is allowed and that sshd is checking the expected authorized-key file. If client evidence does not explain the failure, inspect server authentication logs using the service and logging tools for that operating system.
- Check restrictions last. Account allow/deny rules,
Matchblocks, options on an authorized-key line, revoked-key lists, or provider-installed configuration can affect a key that otherwise appears correct.
Why is my SSH key being ignored?
The client is selecting a different key
When several identities are available, the client may not offer the one whose public half is installed on the server. Verbose output helps show what is being tried. You can explicitly select a private key for a test with ssh -i ~/.ssh/my_key user@server. If that resolves the issue, configure the intended identity for the host in the client’s ~/.ssh/config; Ubuntu’s OpenSSH guide describes per-target client configuration.
The identity is unavailable or locked
A missing key file, an unloaded agent identity, or an unentered passphrase can stop the intended key from being used successfully. Keep the private key on the client and protect it. If the client reports a signing or agent error, check the agent state and load the intended identity with ssh-add ~/.ssh/my_key where appropriate.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The server account or authorized-key path is wrong
Verify the username as carefully as the key: the authorized keys are associated with an account, not automatically shared across users. The OpenSSH daemon’s AuthorizedKeysFile setting controls where keys are read; inspect the effective configuration rather than assuming the default path if the setup is customized. The Ubuntu Noble daemon manual documents the setting and default locations: Ubuntu Noble sshd(8) manual.
Authorized-key files use one public key per line. Compare the public key you intended to install with the key associated with the private identity offered by the client; do not paste or transfer the private key to the server.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do I fix SSH key permissions?
OpenSSH can reject public-key authentication if the authorization path is writable by someone other than the account owner. Its sshd(8) documentation explains that, with strict permission checking, writable user files or directories can cause the server to ignore authorized keys. The authorized-key file must be owned by the user and must not be writable by anyone else. Ubuntu’s guide also advises limiting write access on the file to the authenticated user.
Inspect the home directory, .ssh, and authorized-key file as a path, not just the final file. Check ownership as well as mode bits: changing only the file’s permissions will not correct a wrong owner or an unsafe parent directory. Use mode values appropriate to the account and platform after identifying the actual problem. Do not disable StrictModes or grant broader write access to make authentication work; those checks help prevent unauthorized changes to the authorization path.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How can server logs narrow down the cause?
Client output shows which identity was offered and the authentication exchange from the client’s perspective. Server authentication logs can show whether sshd found an authorized key and why it rejected access. If you administer the server through another session or console, check logs while reproducing the failed login. Ubuntu documents sudo journalctl -fu ssh.service for following the SSH service journal on Ubuntu systems.
Service names, log destinations, and configuration paths vary across distributions and customized images. Confirm the installed system’s service name and OpenSSH manual before changing settings or restarting sshd. If you edit server configuration, verify it with the platform’s supported validation method and preserve an existing working session until the new connection succeeds.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
What if the key and permissions look correct?
Check the effective server configuration for public-key authentication settings and any account-specific Match rules. Then inspect access controls such as allow/deny directives, authorized-key line options, and revoked-key configuration. The OpenSSH daemon manual documents authorized-key lookup and revoked keys, but the active configuration depends on the installed system.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not carry historical configuration snippets across versions without checking the local OpenSSH documentation. In particular, an older troubleshooting page may mention settings that are not appropriate as universal current guidance. The Ubuntu Noble manual is version-scoped; another distribution or release can package a different OpenSSH version.
When should you consider changing the key?
Replace or add a key only after confirming the existing public key is not installed, does not match the offered private identity, or is otherwise unusable. Ubuntu Server documentation recommends the Ed25519 algorithm, citing its shorter key size and lower computational requirements, and shows ssh-keygen -t ed25519. It lists RSA with a 4096-bit key as an alternative. This is Ubuntu’s documented recommendation, not a claim that algorithm choice explains a particular login failure. The Ubuntu Noble sshd(8) manual states that its sshd enforces a minimum RSA modulus size of 1024 bits; that implementation threshold is not a recommendation to create 1024-bit RSA keys.
Disabling or locking an account password does not remove access granted by an already authorized public key. To revoke SSH access, administrators must review authorized keys and applicable access controls, not rely on password status alone.
What if you are locked out of the server?
If no SSH session works, use the hosting provider’s documented console or rescue environment to inspect the target account, authorized-key file, permissions, and sshd configuration. Recovery steps and interface names are provider-specific; do not assume Ubuntu’s service command or a particular rescue workflow applies to every VPS or VDS image.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
