“Access denied” in PuTTY or WinSCP means the SSH connection reached a server, but every authentication method the client tried was rejected. It does not, by itself, prove that your password is wrong, that PuTTY is broken, or that a firewall is blocking you. The usual causes are an incorrect VPS username, a password-disabled image, the wrong private-key format, an unintended key offered by Pageant or ssh-agent, a misplaced public key, restrictive file permissions, or an account policy that disallows the login.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Use the sequence below: first separate authentication failures from network failures, then verify the session fields, test through the VPS provider’s console, and change one credential or policy variable at a time. This approach works for both terminal access in PuTTY and SFTP/SCP sessions in WinSCP because both ultimately depend on the same SSH server policy.
As an Amazon Associate I earn from qualifying purchases.
What “Access denied” actually tells you
PuTTY’s manual describes “Access denied” or “Authentication refused” as the point at which PuTTY has run out of ways to authenticate you to the SSH server. In practical terms, TCP connectivity and the SSH protocol negotiation have progressed far enough for the server to request credentials. The failure occurred during login.
WinSCP can try several methods in a configured order, including GSSAPI, a public key supplied by Pageant, a selected private key, keyboard-interactive authentication, and a password. A wrong username, rejected key, disabled account, expired password, or an agent key that the server does not recognize can therefore produce a similar denial. The message is a symptom, not a diagnosis.
#1 Best Overall
Authentication errors versus connection errors
| What you see | Most likely stage | Start here |
|---|---|---|
| Access denied, Authentication refused, Server refused our key, or Too many authentication failures | The SSH service was reached and login methods were rejected | Username, password/key selection, agent behavior, account policy, and server logs |
| Connection timed out | The client did not receive a response | VPS availability, address, port, routing, proxy, and firewalls |
| Connection refused | The address responded, but no service accepted the connection on that port | SSH service status, port number, provider firewall, and server firewall |
| Protocol or service mismatch | The client is not speaking the protocol expected by the endpoint | Select SSH/SFTP rather than FTP or FTPS and verify the destination port |
If one client reaches an authentication prompt while another times out, do not troubleshoot passwords first. They may be using different ports, proxies, address families, or firewall rules.
Verify the PuTTY or WinSCP session before changing the server
Correcting a single field often resolves the problem. Compare the client configuration with the VPS provider’s connection details rather than relying on a saved session that may be obsolete.
- Confirm the host. Enter the VPS’s current public IP address or hostname. If the provider reassigned the address, an old saved hostname can point to a different machine.
- Select the right protocol. In PuTTY, choose Session and set Connection type to SSH. In WinSCP’s login dialog, choose File protocol: SFTP (or SCP only when the server and your workflow require it). Do not select FTP or FTPS for an SSH login.
- Check the port. SSH uses port 22 by default, but a provider or administrator may configure another port. Use the documented SSH port, not automatically 22.
- Enter the operating-system account. The username is the account inside the VPS image, such as the distribution’s provisioned administrator, not necessarily the email address or password used for the hosting control panel. A key installed for one account will not authenticate as another account.
- Review proxy settings. A proxy configured in WinSCP or PuTTY can send the connection somewhere other than the VPS. Disable an unneeded proxy or enter the provider’s required proxy details.
Save a separate test session with the verified host, port, protocol, and username. Keeping these values fixed makes later tests meaningful.
Use the VPS provider console to separate network and login problems
A browser-based, serial, or out-of-band console connects to the virtual machine without depending on your local SSH path. If the console works but PuTTY or WinSCP does not, the VPS is probably running and the investigation can focus on SSH credentials, account policy, port selection, or local network controls. If the console also shows that the service or account is unhealthy, repair the server first.
From the console, inspect the following areas. Command names differ by Linux distribution and provider, so use the service and log locations documented for your image rather than copying one command blindly.
- SSH service status: Check whether the service is running and listening on the expected port. Some distributions name the service
ssh; others usesshd. - Authentication logs: Review the system journal or the distribution’s authentication log immediately after a failed attempt. Messages such as “invalid user,” “publickey,” “authentication failure,” “account locked,” “not allowed,” or “bad ownership” identify the failing layer.
- Account existence and shell: Confirm that the intended login account exists, has a valid interactive shell, and is not locked or expired.
- SSH policy: Check whether configuration rules such as
AllowUsersorDenyUsersrestrict the account, and whether password or root login has been disabled. - Key placement: Verify the account’s home directory and its
.sshdirectory, then inspectauthorized_keysas described below.
Make one change, test once, and read the resulting log entry. Broadly editing SSH configuration without a console recovery path can lock out every remote administrator.
When password authentication is rejected
Use the VPS account password, not the control-panel password
Hosting dashboards commonly have credentials that are unrelated to operating-system accounts. Enter the password assigned to the VPS user. If you reset it in the dashboard, verify whether the reset changed the Linux account password or only the provider portal credential.
Rule out local typing errors
- Check Caps Lock and the keyboard layout used by the client computer.
- Type the password manually once rather than pasting a value that may include a trailing space or an invisible line break.
- Confirm that you are entering the password at the SSH prompt for the expected username.
SSH password prompts normally do not echo characters. A blank-looking prompt does not mean that keystrokes are being ignored.
Check whether the image permits password login
Many hardened VPS images disable SSH password authentication and require a public key. In that case, a perfectly correct password is rejected by policy. The console and authentication log will show whether password authentication is disabled. Enable it only if your security policy permits it; otherwise configure the correct key for the account.
Check account state and login policy
An expired password, locked account, disabled account, invalid shell, or an AllowUsers/DenyUsers rule can deny a password even when the value is correct. Provider images may also disable direct root login. Use the console to identify the exact reason and to create or unlock a permitted administrative account when appropriate.
Recommended Free Tools
When a private key is rejected
Select the key in the correct client page
In PuTTY, open the saved session and go to Connection > SSH > Auth (the exact label may appear as Authentication in newer builds), then select the private-key file. In WinSCP, open Advanced Site Settings > SSH > Authentication and set the private-key file there. Save the session after verifying the path so a later launch does not silently fall back to password authentication.
Match the private-key format
PuTTY’s traditional private-key format is PPK. OpenSSH and ssh.com private keys use different encodings. WinSCP expects a PuTTY-format private key for direct use in its private-key field, but it can convert OpenSSH or ssh.com keys. Use the client’s conversion option or PuTTY’s key-conversion utility to create a PPK copy, then select that converted file. Do not rename an OpenSSH file to end in .ppk; changing the filename does not change its format.
Keep the original private key protected and make the conversion on a trusted computer. If the key is encrypted, enter its passphrase when prompted. A passphrase protects the private key file; it is not the VPS account password.
Make sure the public half belongs to this VPS account
A key pair authenticates only when the server has the matching public key under the account being used. A key installed in /home/alice/.ssh/authorized_keys will not authenticate a session that logs in as bob. Check the target account’s file from the provider console and compare the public-key text with the key selected in PuTTY or WinSCP.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRepair ownership and permissions
OpenSSH may refuse a key when the account’s home directory, .ssh directory, or authorized_keys is writable by an inappropriate user. The file must be owned by the login account (or by an explicitly permitted administrative arrangement), and the parent directories must not be broadly writable. WinSCP’s public-key guidance recommends mode 600 for authorized_keys. Apply the equivalent restrictive ownership and permissions for your distribution, then retry and read the server log if it still fails.
Control Pageant and ssh-agent before blaming the key
PuTTY and WinSCP can use keys held by Pageant, while other setups use OpenSSH ssh-agent. Agents are convenient, but an agent containing many unrelated keys can cause the client to offer them before the intended key. Some SSH servers stop accepting attempts after too many offered keys, producing “Too many authentication failures” even though the correct key exists.
Test without an agent
- Temporarily disable the option that uses Pageant or an SSH agent in the client’s authentication settings.
- Leave only the intended private key selected in the session.
- Reconnect with the verified host, port, and username.
If the connection succeeds, the server and key are sound; the agent’s key list or offer order caused the denial. Remove unrelated keys from the agent or run a separate agent containing only the VPS key, then re-enable agent use if desired.
Do not confuse an agent key with a server-installed key
Loading a private key into Pageant does not install its public key on the VPS. The corresponding public key still has to appear in the target account’s authorized_keys. Conversely, selecting a local key file does not guarantee that the server has its public half.
Rank #4
Check SSH account and server policies
Authentication can fail after a cryptographically correct key or password reaches the server because policy rejects the account. From the console, check these conditions:
- Root-login policy: Many images disable direct root SSH login. Use the provider’s documented administrative user and elevate privileges after login when permitted.
- Password policy: Password authentication may be disabled globally or for a particular account.
- Key-only or method restrictions: SSH configuration can require public-key authentication or restrict methods for selected users.
AllowUsersandDenyUsers: An account can be excluded even with a valid credential.- Account expiration or lock: A disabled, expired, or locked account will be denied until its state is repaired.
- Login shell: An account assigned a non-interactive or invalid shell may authenticate but be disconnected or refused for interactive use.
- Home-directory access: Incorrect ownership or permissions can prevent the SSH server from reading the account’s key file.
After editing SSH configuration, validate the syntax using the distribution’s documented method and retain the console session until a new remote login has succeeded.
When to investigate firewalls, ports, and local security software
Firewalls are not the first explanation for an explicit authentication denial. Investigate them when you see a timeout or connection refusal, or when one client works while another cannot establish the SSH connection.
Free tools Windows power users keep installed
One-click scans. No signup required.
Server-side and provider firewalls
Confirm that the provider’s network firewall allows inbound TCP traffic on the VPS’s documented SSH port from your source address. Then check the operating-system firewall for the same port. A rule allowing port 22 does not help if SSH was deliberately moved to another port, and a provider firewall rule cannot fix an SSH service that is not listening.
Local firewall and endpoint security
WinSCP notes that per-application firewall rules can block a newly upgraded executable even when an older version has an exception. If PuTTY or WinSCP alone cannot connect, inspect the local security product’s application rule and create a narrowly scoped allow rule for the current executable if your organization permits it. Do not disable endpoint protection permanently as a troubleshooting shortcut.
Proxy and network path
A corporate proxy, VPN, or restrictive network can alter the path or block non-standard ports. Compare a direct connection from a permitted network with the original attempt, while keeping the VPS host, port, username, and key unchanged.
Best Value
Password versus public-key login
| Consideration | Password login | Public-key login |
|---|---|---|
| VPS image support | Works only when SSH password authentication is enabled and the account is permitted to use it | Works when the matching public key is installed for the target account and public-key authentication is allowed |
| Recovery when credentials are lost | A console password reset may restore access if password login remains enabled | You need console access or another administrator to install a replacement public key; losing the only private key can require recovery work |
| Client complexity | Requires the correct account password and careful typing | Requires the matching private key, compatible format, optional passphrase, and correct agent behavior |
| Auditability | Account and password events appear in authentication logs, but the credential itself is shared knowledge | Logs can identify the account and key identity, and separate keys can be revoked independently |
| Brute-force exposure | Exposes a password authentication path that can be attacked if reachable | With password login disabled, possession of the private key is required; protect the key and its passphrase |
The safer choice depends on the image and your operating policy. Do not enable password login merely to bypass a key-format or account-placement mistake.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →PuTTY versus WinSCP for this problem
| Client | Primary job | Where to inspect authentication | Useful diagnostic role |
|---|---|---|---|
| PuTTY | Interactive SSH terminal administration | Connection > SSH > Auth for the private key and agent-related options | Shows the shell login sequence and lets you test the exact account interactively |
| WinSCP | SFTP or SCP file transfer over SSH | Advanced Site Settings > SSH > Authentication | Provides detailed session logs and tests whether the same SSH policy permits file-transfer access |
Neither client can override a server-side restriction. If both fail with the same username and key, examine the VPS logs rather than reinstalling both applications.
A controlled retest procedure
- Write down the provider-confirmed host, SSH port, protocol, and operating-system username.
- Open a fresh PuTTY or WinSCP session instead of relying on an old saved profile.
- Choose exactly one authentication path: the known password or the matching private key. Disable agent use for the test.
- Attempt one connection and record the complete client message and the server log entry at the same time.
- Change only the suspected variable: for example, select the converted PPK, correct the username, or repair
authorized_keysownership. - Retry once. If the result changes from timeout to authentication denial, return to the authentication branch; if it changes from denial to success, document the fix before re-enabling optional settings.
Avoid changing the port, username, key, firewall, and SSH configuration simultaneously. You will lose the evidence that identifies the original fault and may create a second lockout.
Quick decision checklist
- Authentication wording? Investigate credentials, keys, agents, and account policy.
- Timeout or refusal? Investigate VPS availability, protocol, port, proxy, and firewalls first.
- Correct host and port? Confirm the provider’s current values; port 22 is only the default.
- Correct operating-system username? Do not substitute the hosting-dashboard login.
- Password accepted by the image? Hardened images often require keys.
- Right private-key format? Convert OpenSSH or ssh.com keys when a PuTTY-format PPK is required.
- Agent controlled? Disable Pageant or ssh-agent temporarily or load only the VPS key.
- Public key installed for this account? Verify the exact
authorized_keysfile. - Safe ownership and permissions? Use account ownership and restrictive modes; WinSCP recommends
600forauthorized_keys. - Account allowed to log in? Check locks, expiration, shell, root policy, and
AllowUsers/DenyUsers. - Server log consulted? Use the console log message as the deciding evidence before broad changes.
When the console works but PuTTY or WinSCP does not
This situation narrows the problem but does not identify one cause. The console may use a provider-managed account or a different path, while your remote client uses another username, port, key, or protocol. From the console, compare the account that works with the account configured in the client, inspect the SSH listening port, and verify that the client’s public key is installed under the same account. Then test with agent use disabled and with the provider-confirmed port.
If the server log records no entry at all for a failed remote attempt, the request may not be reaching that SSH service; investigate address, port, proxy, and firewall differences. If the log records a rejected username, key, or policy, stay on the authentication branch.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
