Linux · medium · Core system faults

"Permission denied (publickey)"

The server rejected every key the client offered. In practice it is nearly always file permissions on the server side, or the client offering a key the server has never seen.

What you see

ssh exits immediately with this message. Password authentication is often disabled, so there is no fallback and you are locked out.

What is actually wrong

authorized_keys or the home directory has permissions the server refuses to trust, the key is in the wrong account's file, the client is offering a different key, or SELinux has the wrong context on the file.

Codes and articles

Permission denied (publickey)Permission denied (publickey,gssapi-keyex,gssapi-with-mic)

Fixes (2)

Work out what the client is doing before you lose the session

Shell on the client10 minuteslow riskreversible

No other access. Diagnose from the client first — and if you have a working session open anywhere, keep it open.

Run with verbose output and read which keys are offered and how the server answers.
Shell
```
ssh -vvv user@host 2>&1 | grep -Ei 'offering|authentications that can continue|no such|denied'
```
The 'Offering public key' lines tell you exactly what the client sent. If your intended key is not listed, the problem is entirely client-side.
Force the specific key and stop the agent offering others.
Shell
```
ssh -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes user@host
```
An agent with many keys can exhaust MaxAuthTries before reaching the right one, which the server reports as this same error.
Check the local key permissions — OpenSSH refuses to use a private key others can read.
Shell
```
chmod 700 ~/.ssh && chmod 600 ~/.ssh/id_ed25519
```
Confirm the public key you think is installed matches the private key you are using.
Shell
```
ssh-keygen -y -f ~/.ssh/id_ed25519 | awk '{print $1, $2}'
```
Check you are connecting as the right user — cloud images use ec2-user, ubuntu, admin or similar, not root.

Confirm it workedThe connection succeeds.

If you need to undo itNone.

Fix the server side

Console or another session on the server20 minutesmedium riskreversible

You have another way in. Keep that session open until SSH is confirmed working from a second terminal.

Read the server's own reason for refusing.
Shell
```
sudo journalctl -u ssh -u sshd -n 50 --no-pager
```
Fix permissions. sshd refuses group- or world-writable paths anywhere in the chain.
Shell
```
sudo chown -R user:user /home/user/.sshsudo chmod 700 /home/user/.sshsudo chmod 600 /home/user/.ssh/authorized_keyssudo chmod 755 /home/user
```
This is the cause the overwhelming majority of the time, and sshd logs it as 'Authentication refused: bad ownership or modes'.
On RHEL, Rocky, Alma or Fedora, restore the SELinux context.
Shell
```
sudo restorecon -Rv /home/user/.ssh
```
A file created by copying rather than by ssh-copy-id often ends up with the wrong context, and sshd cannot read it even though the mode bits look right.
Confirm the daemon config allows key auth and check for a Match block overriding it.
Shell
```
sudo sshd -T | grep -Ei 'pubkeyauthentication|authorizedkeysfile|permitrootlogin|allowusers|allowgroups'
```
sshd -T prints the effective configuration after all includes and defaults, which is not always what the config file appears to say.
Test the config before restarting, so a typo cannot lock everyone out.
Shell
```
sudo sshd -t && sudo systemctl restart ssh
```

Confirm it workedA brand new SSH session connects while the original one is still open.

Shell

ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 user@host 'echo connected'

If you need to undo itRestore the previous sshd_config and restart. Keep the working session open until the new one is proven.

Related faults

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.