Resolve the Putty password access denied error by verifying your credentials, checking SSH daemon configuration on the server, and ensuring correct user permissions. Common causes include disabled root login, incorrect passwords, or restrictive firewall rules blocking authentication attempts.
Verifying Credentials and Connection Details
The most frequent cause of an "Access Denied" message in PuTTY is simply entering the wrong password or username. Before diving into complex server configurations, ensure that you are typing the correct credentials. Pay close attention to case sensitivity, as Linux-based systems distinguish between uppercase and lowercase letters. If you recently changed your password, make sure you are using the new one. It is also crucial to verify the hostname or IP address you are connecting to. A typo in the address might lead you to a different server where you do not have access. Additionally, confirm that you are using the correct port. The default SSH port is 22, but some servers change this for security reasons. If your system administrator specified a non-standard port, you must enter it in the PuTTY connection settings under the "Port" field. Another subtle issue can arise from copy-pasting credentials. Hidden characters, such as extra spaces at the beginning or end of a password, can cause authentication failures. It is often safer to type the password manually rather than pasting it. If you are copying from a document, check for invisible formatting characters that might interfere with the input.Checking SSH Daemon Configuration
If your credentials are correct, the next step is to examine the SSH daemon configuration on the target server. The file responsible for these settings is typically located at/etc/ssh/sshd_config. One common restriction is the disabling of root login. By default, many modern distributions disable direct root access via SSH to enhance security. Look for the line PermitRootLogin and ensure it is set to yes or prohibit-password if you intend to log in as root.
After modifying the configuration file, you must restart the SSH service for changes to take effect. On Debian-based systems, use the command sudo systemctl restart ssh. On Red Hat-based systems, the command is sudo systemctl restart sshd. Failure to restart the service means the old configuration remains active, and you will continue to face access denied errors.
You should also check the PasswordAuthentication setting. If this is set to no, the server will reject password-based logins entirely, requiring you to use key-based authentication instead. Ensure this is set to yes if you plan to use passwords. Remember that any change to sshd_config requires a service restart.
Inspecting User Permissions and Groups
Sometimes the issue lies with the specific user account rather than the root account. Ensure that the user exists on the system and has the necessary permissions to log in. You can verify this by logging into the server locally or via another method to check the user's status. Users who are locked out or have expired passwords may also receive access denied messages. Check if the user is part of the appropriate groups. For example, if you are trying to perform administrative tasks after logging in, the user must be in thesudo or wheel group. However, this does not affect the initial SSH login itself. If the user account is disabled or has a shell set to /usr/sbin/nologin, SSH connections will be rejected. Review the /etc/passwd file to confirm the user's home directory and shell settings are valid.
For more advanced scenarios involving automated scripts, refer to Using SSH Pass with Bash Script for Remote Access to understand how password handling works in automation contexts. This can help diagnose issues related to how credentials are passed to the SSH client.
Firewall and Network Restrictions
Network-level restrictions can also mimic authentication failures. Firewalls on the server or intermediate network devices might block incoming SSH connections. Check if the server's firewall allows traffic on the SSH port. On Linux, tools likeufw or iptables manage these rules. Ensure that port 22 (or your custom port) is open for inbound connections.
Additionally, some servers implement fail2ban or similar intrusion prevention systems. These tools monitor failed login attempts and temporarily ban IPs that exceed a certain threshold. If you have entered the wrong password multiple times, your IP address might be blocked. Check the server logs for entries related to fail2ban or similar services. If you are banned, you may need to wait for the ban to expire or contact your administrator to remove the block.
Debugging with Verbose Mode
When standard troubleshooting steps fail, enable verbose mode in PuTTY to get detailed information about the connection process. While PuTTY itself does not have a built-in verbose flag like OpenSSH clients, you can use the underlying SSH client if available. Alternatively, check the server-side logs located in/var/log/auth.log or /var/log/secure. These logs provide specific reasons for authentication failures, such as invalid keys, incorrect passwords, or policy violations.
Analyzing these logs can pinpoint the exact stage where the connection fails. Is it failing during the handshake, or after the password prompt? This distinction helps determine whether the issue is network-related or credential-related. Regularly monitoring these logs can also help identify unauthorized access attempts, enhancing your overall security posture.
Frequently Asked Questions
Why does my password work on one machine but not another?
This usually indicates a difference in SSH configuration between the two machines. Check the sshd_config file on the problematic server to ensure that password authentication is enabled and that the user account is not restricted. Differences in firewall rules or SELinux policies can also cause this discrepancy.
Can I reset my SSH password if I am locked out?
If you cannot log in via SSH, you must reset the password through another method, such as console access, a cloud provider's rescue mode, or VNC. Once you have local access, you can use the passwd command to change the user's password. Always ensure you have backup access methods before relying solely on SSH.
How do I fix permission denied for public key errors?
This error occurs when the SSH private key has incorrect permissions. On the client side, ensure the private key file is set to 600 using chmod 600 ~/.ssh/id_rsa. On the server side, verify that the .ssh directory and authorized_keys file have the correct ownership and permissions, typically 700 and 600 respectively.
What is the difference between access denied and connection refused?
"Connection refused" typically means the SSH service is not running or the port is blocked by a firewall. "Access denied" means the connection was established, but the server rejected the authentication attempt. Troubleshooting steps differ significantly: for connection refused, check if the service is running; for access denied, check credentials and server policies.
Is it safe to allow root login via SSH?
Allowing direct root login is generally discouraged due to security risks. It is safer to log in as a regular user and use sudo for administrative tasks. If you must allow root login, ensure you use strong passwords or key-based authentication and restrict access to specific IP addresses using firewall rules.