“Server refused our key” means PuTTY reached the SSH authentication stage, offered a public key, and the server rejected it. The network connection and SSH handshake have normally succeeded. Check the remote username, the matching private key, the exact authorized_keys entry, file ownership and permissions, then the server’s SSH policy. PuTTY’s manual notes that this is usually a server-side account or configuration problem rather than a PuTTY defect.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The quickest reliable method is to select one verified .ppk file in PuTTY, connect as the account that owns the installed public key, and compare PuTTY’s Event Log with the server’s authentication log. Those two records usually identify the rejected identity, path, permission, or policy setting.
As an Amazon Associate I earn from qualifying purchases.
What the message tells you
PuTTY has already contacted the SSH service and attempted public-key authentication. It sent the public half of the key pair associated with the private key you selected, and the server declined to accept that key for the account being used. This is different from a DNS failure, a refused TCP connection, or a host-key warning.
In practical terms, investigate five areas in this order:
- Identity: the remote username is the account for which the key was installed.
- Key pair: the selected private key produces the same public key stored on the server.
- File integrity: the key is in the expected account’s
~/.ssh/authorized_keysfile as one intact line. - Access control: the home directory,
.sshdirectory, and key file have acceptable ownership and permissions. - Policy: the SSH daemon permits public-key authentication and the offered key algorithm.
PuTTY’s manual describes the message as the server refusing a public key it was offered and says wrong ownership or permissions are common causes. Treat the wording as evidence that authentication reached the server, not as proof that the private key file itself is damaged.
Use this decision path before changing anything
| Observation | Most likely location | First check |
|---|---|---|
| PuTTY never reaches a password or key prompt | Connection, username, or server authentication policy | Confirm the host, port, account name, and the SSH service log |
| The Event Log says a key was offered and the server refused it | Remote account or SSH configuration | Compare the selected key with authorized_keys |
| The key works for one account but not another | Wrong home directory or missing per-user key file | Check that account’s ~/.ssh/authorized_keys and ownership |
| The key works after Pageant is cleared | Client identity selection | Load only the intended key or select it directly in PuTTY |
| The server log reports ownership, mode, or algorithm errors | Server policy or filesystem access | Apply the logged correction, then retry with one key |
Do not regenerate keys or reinstall PuTTY until these checks show that the existing pair is unusable. Replacing a key can hide a wrong-username or wrong-file problem and may lock out other administrators.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →1. Verify the remote username
A public key is authorized for a specific account. A correct key offered to the wrong account is still rejected.
- Open the saved PuTTY session.
- Go to Connection > Data.
- Set Auto-login username to the account that owns the installed public key, or leave it blank and enter that account when prompted.
- Connect again and confirm the username shown in the server log.
Cloud images often have an image-specific default account rather than the name you use on your Windows PC. For an Amazon Machine Image, follow the image documentation for its default username; using an administrator name that does not exist on the image produces the same key-rejection symptom. If you can log in with another method, run whoami and inspect that account’s home directory before installing or moving a key.
Check capitalization and spelling. User names, home-directory paths, and account aliases can differ on case-sensitive systems. If a provisioning script created the key under one account while you are connecting as another, copy the public key to the intended account instead of loosening permissions globally.
Rank #2
- Portable Design: 11.2" L x 7.3" W x 1.6" T. Optimized key case holds up to 24 keys. Optimal choice for bankers, businessmen, landlords, hotel managers, real estate agents, car dealers, etc.
- Watertight & Fireproof: With soft and smooth silicone coating, it can resist high temperature up to 2000 °F. Effectively protect keys from heat, water or other extreme conditions.
- Reliable & Reusable: Perfect 3-layer covers with excellent durability. Outer layer: protective silicone coating and fiberglass fabric. Middle layer: cardboard for supporting the whole structure. Inner layer: cozy oxford cloth.
- Flexible Hooks: Come with sturdy ABS hooks rotating freely to flexibly arrange multiple keys. Firmly fixed by thick and well-sewn nylon straps, they are long-lasting and unlikely to fall out.
- 24 Key Tags: Contain soft and pliable key tags (10 colors) with removable labels to write and clear windows for easy visibility. Great readable method to track your keys quickly.
2. Select the private key that matches
PuTTY must use the private key whose public half is installed on the server. Having a file with a plausible name, such as id_rsa.ppk, does not prove that it is the matching identity.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- In PuTTY, open Connection > SSH > Auth.
- Use the private-key file chooser to select the intended
.ppkfile. - If the key was created in OpenSSH format or another foreign format, open it in PuTTYgen, import it, and save it in PuTTY’s
.ppkformat. - Save the session and reconnect.
Keep the original key protected while converting it. Conversion changes the container format; it does not make an unrelated key pair match the server. If you have several candidate keys, identify each one by opening it in PuTTYgen and comparing its displayed public-key text with the line on the server. Do not paste a private key into a chat, ticket, or shell history.
A key can also be selected indirectly through Pageant. Until the basic test succeeds, select the intended .ppk directly in PuTTY so that an old or unrelated Pageant identity cannot be mistaken for the key you are troubleshooting.
3. Inspect the target account’s authorized_keys file
On the server, open the file belonging to the exact username used for the connection:
~/.ssh/authorized_keysThe public key corresponding to the selected private key must appear there as one complete, unbroken line. The line normally contains a key type, a long encoded value, and optionally a comment. The comment is not the identity check; the encoded key data is.
Recommended Free Tools
Common content mistakes
- The line was wrapped onto two lines while being copied.
- Characters were removed or added at the beginning or end.
- The key was pasted into another user’s home directory.
- The file is in a different path because the daemon’s
AuthorizedKeysFilesetting was changed. - A new key replaced the old line instead of being added alongside it.
- Extra configuration text or shell prompts were pasted into the file.
If you have console or alternate access, copy the public key again from PuTTYgen and compare it carefully. Preserve the line ending format expected by the server; an accidental line break in the middle of the encoded value makes the entry invalid. Microsoft’s OpenSSH troubleshooting guidance also identifies a missing or incorrect authorized_keys file as a cause of public-key failures.
Check the path by expanding the account’s home directory rather than assuming that /home/name is correct. A service account, chroot, or customized SSH configuration can place the authorized-key file elsewhere.
4. Repair ownership and permissions
SSH commonly refuses to use a key when an untrusted user can modify the account’s home directory or key file. The account should own its home directory, .ssh directory, and authorized_keys file, and those locations should not be writable by inappropriate users.
For a typical Unix-like server, a commonly used baseline is:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keysFrom an account with permission to correct ownership, replace account with the actual login name and group used by that system:
Rank #4
- PRODUCT DIMENSIONS: approximately 8.25 x 9.8 x 1.57 inches, medium size with 24 key keychains for easy to carry.
- LARGE CAPACITY: This leather key case helps to stay stay neat & organized. It contains 24 key rings with labeling position, convenient to distinguish the keys, you just need to write the description on the paper and insert it into the corresponding label card slot.
- MAKE THE BEST FIRST IMPRESSION: Inspired by sleek design. This professional portfolio leather folder is made of high-grade PU fabrics for a high-end look at an affordable price. Durable, smooth and shiny, feels good! Individuation key ring design, the structure is easy to assemble and disassemble.
- EXCELLENT OFFICE APPLIANCES: This portable key bag is perfect for banker, hotel executives, lawyers, businessmen, landlord, property managers & more. It is especially suitable for estate agents and car rental service, car dealerships and repair shops!
- SUPERIOR SERVICES : We are committed to quality products and superior service. Just contact us if you have any product quality problem and we will solve the problem for you ASAP.
chown -R account:account /home/account/.sshVerify the home directory as well. Many SSH configurations require that it not be group- or world-writable. Do not blindly apply a mode from another operating system or hosting image; check the server’s policy and the authentication log first. A directory that is too restrictive can prevent the daemon from traversing it, while one that is writable by other users can cause the daemon to reject the key for security reasons.
What to inspect
- The home directory is the one assigned to the login account.
~/.sshis a directory, not a regular file or symlink to an inaccessible location.authorized_keysis readable by the account and not writable by unrelated users.- Ownership is correct after copying files with
sudo, a deployment tool, or a backup restore. - Mandatory access-control systems or a chroot are not denying access even when Unix modes look correct.
After changing permissions or ownership, retry once and read the server log. If the log still reports a path or ownership problem, follow that exact path rather than repeatedly tightening modes.
5. Confirm the SSH server policy
A matching key can still be rejected when the daemon is configured not to use public keys, to read a different file, or to disallow the key’s algorithm.
Public-key authentication and file path
Review the effective SSH configuration, including any included files, for settings that disable public-key authentication or redirect the authorized-key file. The relevant settings are commonly named PubkeyAuthentication and AuthorizedKeysFile, but distributions and managed services can add account-specific rules. Ensure that the file path resolves inside the target user’s actual home directory.
Algorithm and account restrictions
Current SSH policies may reject an older or disallowed key algorithm even when the key text is present. The server log normally identifies an algorithm restriction. Other policy controls can include a disabled account, an expired account, a forced command, a source-address restriction, a chroot, or a rule in a per-user configuration block.
Best Value
- Package Includes: Pack Of 1 Piece Large Key Holder And 28 Piece Small Key Ring And 30 Piece Assorted Color Plastic Key Tags
- Size Information: This Silver Key Organizer Length Is About 5.9 Inches (15 cm), Width Is About 5.5 Inches (14 cm), Made Of High Quality Stainless Steel
- Unique Design: Smooth Plastic Handle,Safe For Your Hand,1-28 Numbers Mark On Key Chain,Also Come With 28 Separable Portable Key Rings,So Easy To Distinguish,You'll Need To Assemble The Key Rings And Key Tags By Yourself
- Effective Management: 30 Assorted Color Black Green Red Blue Yellow Plastic Key Tags,Organize And Identify With Assorted Colors Tag With Blank Inserts
- Widely Used: Great For Large Family Multi Key Management, Hotel, Rental Housing,School, Factory Warehouse, Office, Home, Apartments And Workshop Use
Change only the policy that the log shows to be responsible. On a production host, preserve a working administrative session while editing the configuration, validate the syntax with the platform’s SSH configuration test, and reload the daemon using the operating system’s documented service command. A configuration mistake can terminate access for every user.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Read PuTTY’s Event Log and the server log together
PuTTY explicitly recommends its Event Log for this error. Open the log from the active session window and record which key was offered, whether Pageant supplied an identity, and any diagnostic text returned by the server. The log is useful evidence, but the server decides whether the key is authorized.
At the same time, watch the SSH authentication log or system journal on the remote host while making one connection attempt. The exact file varies by distribution and logging setup. Look for messages at the timestamp of your attempt, such as:
- Bad ownership or modes: correct the home,
.ssh, orauthorized_keyspermissions. - Authentication refused: inspect account restrictions and the effective SSH policy.
- Could not find or read authorized keys: verify the username, home directory, path, and file readability.
- Key not found: compare the offered public key with the file’s intact line.
- Algorithm disabled: use a key type permitted by the server’s current policy or make a deliberate policy change.
Copy the relevant log lines before making changes. A second attempt after a fix should produce a visibly different server-side result; that is more reliable than guessing from PuTTY’s final dialog alone.
7. Retest with exactly one identity
Multiple keys can obscure the diagnosis. Pageant may offer identities you forgot were loaded, and a server can stop accepting attempts after too many offers.
- Close the failed session.
- Temporarily remove unrelated identities from Pageant, or exit Pageant if your workflow allows it.
- In Connection > SSH > Auth, select only the verified
.ppk. - In Connection > Data, enter the verified remote username.
- Reconnect while watching both logs.
If this succeeds, the earlier failure was an identity-selection problem rather than a damaged server key file. Add other Pageant identities back one at a time and keep the working key associated with the correct session.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhen the symptom says “No supported authentication methods available”
That message is broader than “server refused our key.” It can mean that the server offers no method PuTTY can use, that public-key authentication is disabled, or that PuTTY did not successfully offer a usable identity. Start by checking whether the Event Log records a public key being offered.
- If a key was offered and refused, follow the username, matching-key, file, permission, and policy sequence above.
- If no key was offered, check the Connection > SSH > Auth selection, the
.ppkformat, and Pageant state. - If the server offers only a method your account cannot use, review the server’s authentication configuration and account policy.
Do not interpret the broader message as proof that the network is down. The server and client logs are the authority on which authentication methods were actually attempted.
Quick Recap
Fixes that commonly fail
- Changing the PuTTY window or port without evidence: the refusal occurs after the SSH handshake, so network changes do not repair an unauthorized key.
- Generating a new key immediately: a new pair will also fail if it is installed for the wrong username or in the wrong path.
- Making files world-writable: this can cause the daemon to reject them and weakens account security.
- Copying the private key to the server: the server needs the public key; keep the private key on the client and protect it.
- Testing through Pageant with many identities loaded: this makes it unclear which key PuTTY offered.
- Editing a global SSH configuration without a rollback path: a syntax or policy error can lock out every account.
A repeatable recovery checklist
- Record the exact username, host, port, and time of the failed attempt.
- Open PuTTY’s Event Log and confirm whether a public key was offered.
- Set the intended account under Connection > Data > Auto-login username.
- Select the matching private key under Connection > SSH > Auth; convert it with PuTTYgen if it is not a
.ppk. - On the server, verify the corresponding public-key line in that account’s
~/.ssh/authorized_keys. - Check the home directory,
.ssh, andauthorized_keysownership and permissions. - Review effective SSH policy, authorized-key path, algorithm rules, and account restrictions.
- Compare the server authentication log with the PuTTY Event Log.
- Retest with Pageant cleared or with only the verified key selected.
- Keep the working session open until the new login is confirmed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
