Permission denied (publickey) — every reason SSH rejects your key

Permission denied (publickey) means the SSH connection succeeded but authentication failed: the server would not accept your key (and password login is off, which is why it does not fall back to a prompt). The fix is almost always one of four things — wrong key offered, wrong user, wrong file permissions, or the key never made it into authorized_keys.

Start with verbose output

The -v flag tells you exactly which keys the client offered and how the server responded. Read it before changing anything:

ssh -v user@host
# look for lines like:
#   Offering public key: /home/you/.ssh/id_ed25519
#   Authentications that can continue: publickey

1. Are you logging in as the right user?

A key in root’s authorized_keys does nothing for ssh ubuntu@host. Cloud images have a default account — ubuntu, debian, admin, ec2-user, rocky — and the key is usually installed there, not for root.

2. Is the client offering the right key?

If -v shows it never offers your key, point at it explicitly:

ssh -i ~/.ssh/id_ed25519 user@host

Make it permanent in ~/.ssh/config so you never guess again:

Host myserver
    HostName 203.0.113.10
    User ubuntu
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

3. File permissions on the server

sshd refuses keys silently if the files are group- or world-writable. This is the single most common cause after a manual copy. Fix them from a working session or the console:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chown -R $USER:$USER ~/.ssh

4. Is the key actually installed?

Copy it properly rather than pasting by hand — ssh-copy-id appends it with the right permissions:

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host

# manual equivalent, if password login is still on:
cat ~/.ssh/id_ed25519.pub | ssh user@host \
  "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Confirm you are pasting the .pub file, not the private key, and that it is a single unbroken line beginning with ssh-ed25519 or ssh-rsa.

Check the server config and logs

# what the daemon logged when you tried
sudo journalctl -u ssh -n 30

# make sure key auth is even enabled
sudo grep -Ei 'PubkeyAuthentication|AuthorizedKeysFile' /etc/ssh/sshd_config

A key-only server with no console access is a lockout waiting to happen. On a VMHeaven VPS the panel console and rescue mode let you reset authorized_keys without a reinstall — worth having before you disable passwords.

Frequently asked