You're trying to connect to a server using SSH key authentication, but you keep getting rejected:

bash
$ ssh user@server.example.com
user@server.example.com: Permission denied (publickey).

This error means the server rejected your public key authentication attempt. The cause could be on your local machine, the server, or somewhere in between. Let's diagnose and fix this systematically.

Diagnose the Problem

Start by running SSH with verbose output to see exactly where authentication fails:

bash
ssh -v user@server.example.com

For more detail, use up to three -v flags:

bash
ssh -vvv user@server.example.com

Look for lines like these in the output:

bash
debug1: Offering public key: /home/you/.ssh/id_rsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/you/.ssh/id_rsa
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey

This tells us SSH offered your key but the server rejected it. The problem is likely on the server side.

Check Local Key Permissions

SSH is strict about file permissions. Wrong permissions on your private key will cause rejection:

bash
ls -la ~/.ssh/id_rsa

Correct permissions should show:

bash
-rw------- 1 you you 1679 Apr  3 10:00 /home/you/.ssh/id_rsa

If permissions are too open, fix them:

bash
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub

For the directory containing your SSH files:

bash
chmod 700 ~/.ssh

Verify the Public Key on the Server

The most common cause is that your public key isn't in the server's authorized_keys file. SSH into the server using password authentication:

bash
ssh -o PreferredAuthentications=password user@server.example.com

Check if your public key exists:

bash
cat ~/.ssh/authorized_keys

If the file doesn't exist or your key is missing, add it. First, copy your public key from your local machine:

bash
cat ~/.ssh/id_rsa.pub

On the server, add it to authorized_keys:

bash
mkdir -p ~/.ssh
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ..." >> ~/.ssh/authorized_keys

Or use ssh-copy-id from your local machine:

bash
ssh-copy-id user@server.example.com

Check Server-Side Permissions

On the server, verify permissions for the SSH directory and files:

bash
ls -la ~/.ssh/

Correct output:

bash
total 8
drwx------  2 user user 4096 Apr  3 10:00 .
drwxr-xr-x 6 user user 4096 Apr  3 09:00 ..
-rw-------  1 user user  400 Apr  3 10:00 authorized_keys

Fix permissions if needed:

bash
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Also check your home directory permissions:

bash
ls -ld ~

Your home directory should not be writable by group or others:

bash
chmod go-w ~

Check SSHD Configuration

On the server, verify the SSH daemon allows public key authentication:

bash
sudo grep -E "^(PubkeyAuthentication|AuthorizedKeysFile|PasswordAuthentication)" /etc/ssh/sshd_config

Expected output:

bash
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication no

If PubkeyAuthentication is set to no, change it:

bash
sudo sed -i 's/^PubkeyAuthentication no/PubkeyAuthentication yes/' /etc/ssh/sshd_config

If the line doesn't exist, add it:

bash
echo "PubkeyAuthentication yes" | sudo tee -a /etc/ssh/sshd_config

Then restart SSH:

bash
sudo systemctl restart sshd

Check SELinux or AppArmor

On systems with SELinux (RHEL, CentOS, Fedora), incorrect context can block access:

bash
restorecon -R -v ~/.ssh

Check SELinux status:

bash
getenforce

If enforcing, you can temporarily set to permissive to test:

bash
sudo setenforce 0

If this fixes the issue, the problem was SELinux context.

Verify the Key Type

Newer SSH versions might reject older or less secure key types. Check your key:

bash
ssh-keygen -l -f ~/.ssh/id_rsa.pub

If you're using DSA or RSA keys smaller than 2048 bits, generate a new ED25519 key:

bash
ssh-keygen -t ed25519 -C "your_email@example.com"
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server.example.com

Test the Connection

After making changes, test the connection:

bash
ssh -v user@server.example.com

Look for:

bash
debug1: Authentication succeeded (publickey).

Quick Checklist

  1. 1.Private key permissions: 600 (owner read/write only)
  2. 2..ssh directory permissions: 700 (owner only)
  3. 3.authorized_keys permissions: 600 (owner read/write only)
  4. 4.Home directory not writable by group/others
  5. 5.Public key present in authorized_keys
  6. 6.PubkeyAuthentication yes in sshd_config
  7. 7.Correct SELinux/AppArmor context

The most common fix is adding your public key to ~/.ssh/authorized_keys on the server with correct permissions. Run through this checklist methodically and you'll resolve the permission denied error.