“Permission denied (publickey)” means your VPS was reached, but its SSH server rejected every public-key identity offered for the account. The fastest path to a fix is to run ssh -vvv user@server, confirm the provider’s exact username, explicitly select the matching private key, then use a console or another administrative session to repair the target account’s key file, ownership, permissions and effective sshd policy. Do not start by changing firewall rules: this message is an authentication failure, not a basic network refusal.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the error tells you
SSH has already completed the network connection to the VPS and reached the authentication stage. The server is saying that it could not verify a public key for the account named in your command. A rejected key, a wrong account, an unreadable authorized_keys file, an agent offering the wrong identity, or an sshd policy that does not permit that key can all produce the same final line.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe private key stays on the computer from which you connect. The corresponding public key must be installed on the VPS in the target account’s configured authorized-key file. Possessing a valid key pair is not enough: the username, home directory, file path, ownership and daemon policy must all line up.
Start with verbose client output
Run the connection with maximum normal SSH diagnostics:
ssh -vvv user@serverRead the output from the first identity-related lines. It tells you which files the client tries, which keys an agent offers, whether the server accepts a public key, and whether signing fails locally. Use this evidence to classify the fault before changing anything.
- Client-side selection: the intended private key is not being offered, or the agent is using another key.
- Account or key-file problem: the public key is absent, incomplete, in the wrong user’s file, or unreadable.
- Server policy problem: public-key authentication is disabled, the authorized-key path is changed, or an account restriction blocks login.
- Provider control-plane problem: you have no working administrative route and must recover through a web, serial or maintenance console.
1. Confirm the exact username and private key
VPS images do not share one universal login name. The image and provider may require a distribution-specific default account or a user created during deployment. Use the name documented for that exact image; do not assume that root, your local username or a name used on another server will work.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Select the key explicitly
Once you know the account, tell SSH exactly which private key to use:
ssh -i ~/.ssh/id_ed25519 user@serverReplace the path with the private key that corresponds to the public key installed on the VPS. If you have several keys, an implicit choice from ssh-agent or your SSH configuration can be wrong even though the desired key exists on disk. Re-run ssh -vvv and confirm that the expected identity is offered.
Avoid changing user context accidentally
Running SSH through sudo, a root shell or a different desktop account can change which home directory, agent socket and key files the client sees. A key available to your normal account may not exist for the account that runs sudo ssh. Use the intended local user, or pass the private-key path explicitly and verify the agent context.
2. Verify that the public key is installed for that account
On the VPS, inspect the target account’s configured AuthorizedKeysFile. OpenSSH normally looks in ~/.ssh/authorized_keys (and historically ~/.ssh/authorized_keys2), unless sshd_config changes the setting or an included file overrides it.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCheck the complete key line
Each authorized key must occupy one complete line. It normally starts with a key type such as ssh-ed25519 or ssh-rsa, followed by a base64-encoded key and an optional comment. A wrapped line, a missing prefix, an accidental quotation mark or a line copied into the wrong account will not authenticate.
From an existing administrative session or provider console, display the file without editing it first:
sudo sed -n '1,20p' /home/user/.ssh/authorized_keysSubstitute the actual home directory and account. Compare the installed public key with the public half of the private key on your workstation. You can derive a public key from a private key without exposing the private material:
ssh-keygen -y -f ~/.ssh/id_ed25519Copy the resulting single line and compare it with the line on the server. Keep the key type unchanged; replacing a key with a different pair requires installing that new public key before attempting to use its private half.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Check for a nonstandard path
An administrator may set AuthorizedKeysFile to a path outside the usual home-directory location. The path can also be defined in an included configuration fragment. Do not create a new authorized_keys file until you know which path the running daemon uses.
3. Repair ownership and permissions
OpenSSH commonly refuses keys when the home directory or SSH files are writable by other users, owned by the wrong account, or inaccessible because a parent directory blocks traversal. Exact requirements vary by distribution, image and any account-hardening policy, so inspect the whole path rather than changing only the final file.
Inspect every path component
namei -l /home/user/.ssh/authorized_keysls -ld /home/user /home/user/.sshls -l /home/user/.ssh/authorized_keys
Look for the intended user and group on the home directory, .ssh directory and key file. Also ensure each parent directory permits the target user to traverse it. A correct file mode cannot compensate for a parent directory owned by another account with no execute permission for the user.
Apply a conservative baseline
From a root shell or with appropriate administrative privileges, a common baseline is:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →chown -R user:user /home/user/.ssh
chmod go-w /home/user
chmod 700 /home/user/.ssh
chmod 600 /home/user/.ssh/authorized_keysUbuntu’s documented example removes group and other write permission from the home directory, uses mode 700 for .ssh, and mode 600 for authorized_keys. If your distribution uses a different primary group, substitute that group instead of blindly using user:user. Do not recursively change the entire home directory unless you understand the consequences for application files.
Mandatory access controls and mounted homes
On systems using SELinux or another mandatory access-control layer, labels can prevent sshd from reading a file whose Unix mode looks correct. If the VPS image uses such controls, check the system’s audit log and restore the expected context with the distribution’s supported tool. Similarly, if the home directory is on a mounted volume, confirm that it is mounted at the path used by the account and is available before sshd starts.
4. Check the effective sshd configuration
Editing the wrong configuration file is a common cause of a persistent failure. OpenSSH can include multiple fragments, and a later rule or a match block may apply only to the affected user or network. Inspect the effective configuration rather than relying on one file’s apparent contents.
Confirm public-key authentication
The daemon must allow the publickey authentication method. OpenSSH documents publickey alongside methods such as password; a policy that removes it will reject key logins regardless of file permissions.
Recommended Free Tools
Check the active configuration with your distribution’s supported test and dump commands. On many OpenSSH installations, these forms are useful:
sudo sshd -t
sudo sshd -T | grep -Ei 'pubkeyauthentication|authorizedkeysfile|authenticationmethods|strictmodes'The exact binary path and available options can differ, so use the image’s manual page if a command is unavailable. Treat sshd -t as a syntax check, not proof that the chosen account can log in.
Verify AuthorizedKeysFile and account restrictions
Confirm that the effective AuthorizedKeysFile points to the file you repaired. Then inspect restrictions that can reject an otherwise valid key:
AllowUsers,DenyUsers,AllowGroupsorDenyGroupsrules.AuthenticationMethodsrequirements that demand an additional factor.- A
Match User,Match GrouporMatch Addressblock applying a different key path or authentication policy. PermitRootLoginsettings when you are attempting a root login.- A shell set to
/usr/sbin/nologinor an account that is locked or expired.
Make one controlled change at a time. Keep a working console or SSH session open while validating any policy edit.
5. Fix an SSH-agent or local signing failure
If verbose output shows that an agent offers an unexpected identity or cannot sign with the selected key, load the intended private key into the agent:
ssh-add ~/.ssh/id_ed25519List the identities currently available:
ssh-add -lThen retry with the key explicitly selected and inspect ssh -vvv. If the private key is encrypted, enter its passphrase when prompted. If no agent is available, use -i directly or start the agent through your operating system’s supported mechanism.
Do not copy a private key to the VPS to “make it match.” The server needs only the public key. Keep private-key permissions restricted on the client and remove any accidental copies from shared systems.
6. Recover access when SSH is completely locked out
If no SSH account works, use the provider’s out-of-band route. Depending on the service and region, this may be a web console, serial console, rescue environment or maintenance mode. The workflow differs by provider and image; follow the documented administrative login method rather than assuming that a console accepts the same credentials as SSH.
Console recovery procedure
- Open the VPS provider’s web, serial or maintenance console and authenticate through its supported administrative route.
- Identify the affected account, its real home directory and the filesystem containing it. In a rescue environment, mount the VPS disk before editing files.
- Back up the current SSH configuration and key file before changing them.
- Check the account’s
authorized_keyspath, complete public-key line, ownership and permissions. - Repair the path and modes, then inspect the effective
sshdpolicy and any included fragments. - Run the distribution-supported configuration test. Do not restart a daemon after a syntax error.
- Restart or reload SSH using the image’s service manager, then test from a separate client while the console remains available.
Google Cloud’s documentation describes serial-console and maintenance-mode approaches for SSH failures; other providers expose different controls. A console is valuable because it bypasses the broken SSH authentication path, but it does not remove filesystem, account or daemon-policy errors.
Temporary emergency policy changes
Do not permanently enable password authentication or unrestricted root login merely to regain access. If a recovery window requires a temporary setting, restrict it to the shortest practical interval, limit the source where possible, validate the configuration before restarting, and restore the hardened policy immediately after installing and testing a working key.
Choosing the right fix
| Where the fault appears | Typical evidence | Access required | What changes | Security and reversibility |
|---|---|---|---|---|
| Client key selection | ssh -vvv never offers the intended identity, or the agent lists another key |
Existing local access only | Selects or loads the existing private key | Highly reversible; does not alter the VPS |
| Server account and key file | Correct key is offered but the server rejects it; file is absent, malformed or unreadable | Existing SSH session for another administrator or console | Installs the public key and repairs ownership or modes | Low policy impact; preserve the key type and account context |
| sshd policy | Public-key authentication is disabled, or effective key path differs from the file repaired | Administrative SSH or console | Changes daemon configuration or account restrictions | Potentially high impact; test syntax and keep a fallback session |
| Provider control plane | No account can authenticate and no alternate administrator exists | Web, serial, rescue or maintenance console | Restores filesystem or daemon access outside SSH | Provider-specific and often disruptive; follow its recovery procedure |
Common wrong turns and their corrections
Changing firewall rules first
A firewall or security-group problem normally causes a timeout, refusal or unreachable host. When the server prints “Permission denied (publickey),” packets have reached SSH and the failure is later in the connection. Return to identity, account and daemon checks unless verbose output shows a separate network error.
Trying every username
Repeated guesses can trigger rate limits and obscure the real issue. Confirm the image’s documented account, then inspect that account’s home directory and key file. A correct key installed for one user cannot authenticate as another user unless it is installed in the other user’s configured location too.
Copying the private key to the server
This reverses SSH’s security model and creates a credential exposure. Install only the public half on the VPS and keep the private half on the client that initiates the connection.
Making everything world-writable
Commands such as chmod -R 777 can create a security incident and may still fail strict SSH checks. Use the narrow ownership and modes required by the account, then inspect parent directories and access-control labels.
Restarting sshd without a syntax check
A malformed configuration can disconnect every session. Test first, keep an existing administrative connection open, and use a console fallback before applying a restart.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Preventing a repeat lockout
- Keep at least one second administrative public key installed and test it from a separate client.
- Verify that the provider’s web or serial console is enabled and that you know its supported login procedure before making SSH-only changes.
- Record the image-specific username, home directory and key path in your deployment documentation.
- Use configuration management to preserve ownership, modes and the intended
AuthorizedKeysFilevalue. - After changing keys or
sshd_config, open a new test session before closing the known-good one. - Back up key configuration and keep a dated record of temporary recovery changes so they can be reverted.
A compact diagnostic checklist
- Run
ssh -vvv user@serverand note the identities offered and rejected. - Confirm the provider’s exact username and the private key paired with the installed public key.
- Check whether an agent or
sudochanged the local key context. - From administrative access, locate the effective
AuthorizedKeysFile. - Verify the public key is one complete line in the target account’s file.
- Inspect every path component, then repair ownership and conservative permissions.
- Check effective
sshdsettings, account restrictions and included configuration files. - Run the daemon’s configuration test before reloading or restarting.
- If no SSH route remains, use the provider console or recovery environment.
- Test a second administrative key and restore any temporary security-policy changes.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
