SSH "Permission denied (publickey)": the complete fix path

Published September 28, 2026

⏱️ 2 min read

What the error means

The server offered only publickey auth, and your key did not match any key in ~/.ssh/authorized_keys (or the file was not readable). The message is accurate: it is not a wrong password, it is a rejected key.

Checklist, fastest first

1. Verbose it. ssh -v user@host shows exactly which keys are offered. If yours is not in the list, the client side is the problem; if it is offered and rejected, the server side is.
2. Is the right key loaded? ssh-add -l. If empty: ssh-add ~/.ssh/id_ed25519. Use ssh -i ~/.ssh/id_ed25519 explicitly to test.
3. Permissions. This is the classic:

   chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys
   chmod 600 ~/.ssh/id_ed25519

   StrictModes rejects world-writable files silently.
4. Wrong username. Cloud images vary: root on Vultr, ubuntu on Ubuntu AWS/DigitalOcean images, ec2-user on Amazon Linux.
5. Pubkey not in authorized_keys. ssh-copy-id user@host does it correctly; or append manually and confirm with sudo cat /home/user/.ssh/authorized_keys on the server console.

Server-side settings that bite

On the server, check PubkeyAuthentication yes and that AuthorizedKeysFile was not redirected in sshd_config. After edits: sudo sshd -t && sudo systemctl reload sshd. Keep one console session open while testing lockouts.

Lockouts

If you are managing multiple boxes, key-based access plus a bastion beats password sprawl. For teams, device-aware access control is the grown-up version: NordLayer handles posture checks and per-device access. (Partner link.)