SSH authentication failures on a Raspberry Pi 5 using public keys from Windows 10 typically stem from incorrect file permissions on the target device or improper key formatting in the client environment. Ensuring the
.ssh directory is set to
700 and the
authorized_keys file is strictly
600 resolves most permission-related denials.
Understanding the Permission Model
OpenSSH enforces strict security protocols regarding ownership and access rights for authentication files. If the server detects that private keys or authorized keys are readable by other users, it will silently reject the connection attempt to prevent potential compromise. This behavior is consistent across Linux distributions, including the versions running on the Raspberry Pi 5. The error often manifests as an immediate disconnect or a generic "Permission denied" message without specifying the root cause, leading users to believe their key pair is invalid when it is actually the file system configuration that is at fault.
Verifying Directory Permissions
The home directory of the user attempting to connect must not be group-writable. More critically, the hidden
.ssh directory within that home path must have exclusive read, write, and execute permissions for the owner only. You can verify this by logging into the Raspberry Pi via console or an existing working SSH session and running
ls -ld ~/.ssh. The output should begin with
drwx------. If you see any additional letters such as
r,
w, or
x for group or others, the permissions are too open. Correct this immediately using
chmod 700 ~/.ssh.
Checking the Authorized Keys File
Similarly, the file containing your public keys, located at
~/.ssh/authorized_keys, must also be restricted. It should never be world-readable or writable. Use
ls -l ~/.ssh/authorized_keys to check. The expected permission string is
-rw------- (or
600). If the file was created by pasting content directly into the terminal without proper redirection safeguards, it might inherit looser defaults. Fix this with
chmod 600 ~/.ssh/authorized_keys. Additionally, ensure the file is owned by the correct user using
chown pi:pi ~/.ssh/authorized_keys, replacing
pi with your actual username if different.
Can't connect to SSH on a Raspberry PI provides further context on basic connectivity issues that may compound permission errors.
Windows 10 Client Configuration
While server-side permissions are the most common culprit, the Windows 10 client must also present the key correctly. Modern Windows versions include OpenSSH client tools, but they expect specific formats and locations for keys.
Key Format and Line Endings
If you generated your key pair on Windows using PowerShell or Command Prompt, the resulting public key in
id_rsa.pub must be copied entirely into the
authorized_keys file on the Pi. A frequent mistake is breaking the long string of characters into multiple lines on the Pi side. The
authorized_keys file expects one key per line. If you paste the key and it wraps, it creates invalid entries. Ensure there are no trailing spaces or newlines after the key identifier. You can verify the integrity of the key on the Pi by checking its length; it should match the original public key exactly.
Using the Correct Identity File
When connecting from Windows, explicitly specify the identity file to avoid ambiguity. Use the command
ssh -i C:\Users\YourName\.ssh\id_rsa pi@RaspberryPiIP. If you do not specify the key, OpenSSH looks for default names like
id_rsa in the current directory or the default
.ssh folder. Specifying the path ensures the client uses the exact key you intend. Furthermore, ensure that the private key file on Windows has appropriate permissions itself, although this is less frequently the cause of server-side rejection than client-side specification errors.
Debugging Connection Attempts
When standard fixes fail, verbose logging reveals the exact point of failure. Running the SSH command with the verbose flag provides detailed output about negotiation steps.
Analyzing Verbose Output
Execute
ssh -v pi@RaspberryPiIP from Windows. Look for the line stating
Authentications that can continue:. If it lists
publickey, the server accepts key-based auth. Next, look for
Offering public key. If you see
Server accepts key followed by
Authenticated with partial success, it indicates the key is valid but something else is wrong, often related to shell restrictions or missing home directories. If you see
No more authentication methods to try, the server rejected the key due to permissions or format issues discussed earlier.
Troubleshooting Rsync Error: Protocol Data Stream (Code 12) on Windows 10 and Raspberry Pi highlights how underlying SSH instability can affect other network services.
SELinux and AppArmor Considerations
Although less common on standard Raspberry Pi OS images, some hardened Linux distributions enforce mandatory access controls. If your Pi runs a customized kernel or security module, SELinux contexts might block access to
authorized_keys. Check if the file context is correct using
ls -Z ~/.ssh/authorized_keys. If it lacks the proper
ssh_home_t label, restore defaults with
restorecon -Rv ~/.ssh. For Ubuntu Server users, AppArmor might restrict certain behaviors, though this rarely affects standard SSH key authentication unless custom profiles are applied.
Service Status Verification
Ensure the SSH daemon is actively listening and configured to allow public key authentication. Edit
/etc/ssh/sshd_config on the Raspberry Pi. Verify that
PubkeyAuthentication yes is uncommented. Also, ensure
AuthorizedKeysFile .ssh/authorized_keys points to the correct location. After making changes, restart the service with
sudo systemctl restart ssh.
Cannot Access Private Network When Connecting Through a VPN to My Raspberry Pi discusses network layer issues that can mimic SSH authentication failures.
Frequently Asked Questions
Why does SSH work with password but not public key?
This confirms the server is running and reachable, but specifically rejects key-based auth due to permission errors or misconfigured
sshd_config. Check that
PubkeyAuthentication is enabled and that the
.ssh directory permissions are strictly
700.
How do I fix "Host key verification failed" on Windows?
This is a separate issue from authentication; it means the client doesn't recognize the Pi's host key. Remove the old entry from
C:\Users\YourName\.ssh\known_hosts and reconnect to accept the new fingerprint.
Can I use PuTTY instead of OpenSSH on Windows?
Yes, but you must convert your OpenSSH key to PuTTY format using PuTTYgen. Standard OpenSSH clients on Windows cannot natively read
.ppk files without conversion or specific configuration adjustments.
What if my authorized_keys file is empty?
An empty file will always result in authentication failure. Ensure you have copied the entire content of your
id_rsa.pub file from Windows into the
authorized_keys file on the Pi, ensuring no extra line breaks were introduced.
Does Windows 10 require admin rights to generate SSH keys?
No, standard user accounts can generate and store SSH keys in their personal
.ssh directory. Administrative privileges are only needed if you install the OpenSSH client feature globally via PowerShell.