SSH Connection Permission Denied on New Ubuntu 22.04 LTS Server

SSH Permission Denied on Ubuntu 22.04 typically stems from incorrect file permissions, disabled password authentication in sshd_config, or using the wrong username. Verify your user exists, check /etc/ssh/sshd_config settings, and ensure private keys have strict permissions like 600 to resolve the immediate connection failure.

Verifying Username and Authentication Method

The most common reason for a "Permission denied" error is attempting to log in with a non-existent user or an unsupported authentication method. By default, Ubuntu servers often disable password authentication for security reasons, requiring SSH key-based login instead. If you are trying to use a password, you must first confirm that the user account actually exists on the system. You can verify this by checking the /etc/passwd file or asking your hosting provider if they created a specific user like ubuntu or root. If you are connecting as root, note that many cloud providers disable direct root login via SSH for security hardening. In such cases, you should connect as the default user (often ubuntu for standard images) and then use sudo su - to gain root privileges after logging in. This two-step process avoids the permission denial while maintaining security standards. For those who genuinely need password authentication, you must modify the SSH daemon configuration. Open the configuration file at /etc/ssh/sshd_config and locate the line starting with PasswordAuthentication. Change it to yes and restart the SSH service using sudo systemctl restart sshd. However, relying on passwords is discouraged; generating an SSH key pair and adding the public key to ~/.ssh/authorized_keys is the recommended approach.

Checking File Permissions on the Server

SSH has strict requirements regarding file permissions to prevent unauthorized access to private keys and user directories. If the permissions on your home directory, the .ssh folder, or the authorized_keys file are too open, the SSH server will reject the connection for security reasons. Specifically, the authorized_keys file must not be writable by group or others. To fix this, log in via the console or recovery mode if SSH is blocked, and run the following commands:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chown -R $USER:$USER ~/.ssh

These commands set the directory to read, write, and execute only for the owner, the key file to read and write only for the owner, and ensure the ownership is correct. Incorrect permissions here are a frequent cause of silent failures where the server accepts the connection but immediately closes it with a permission error.

Validating Client-Side Key Permissions

Just as the server checks its own files, the client machine also enforces strict permissions on private keys. If your local private key file (usually located in ~/.ssh/id_rsa) has permissions that allow other users to read it, SSH will refuse to use it. On your MacBook, check the permissions of your key file using ls -l ~/.ssh/id_rsa. The output should show -rw------- (600). If the permissions are incorrect, update them with chmod 600 ~/.ssh/id_rsa. Additionally, ensure that the key you are using matches the public key uploaded to the server. Mismatched keys result in authentication failures. You can test the connection with verbose output by running ssh -v user@server_ip. Look for lines indicating "Offering public key" and whether the server responds with "Server accepts key".

Reviewing SSH Daemon Configuration

Sometimes the issue lies deeper within the SSH daemon configuration. Ensure that PubkeyAuthentication is set to yes in /etc/ssh/sshd_config. Also, verify that the AuthorizedKeysFile points to the correct location, which is typically .ssh/authorized_keys. If you have recently changed the hostname or IP address, ensure that any firewall rules or security groups associated with the instance allow inbound traffic on port 22. For more complex networking issues, refer to our guide on [Ubuntu Server 22.04 Unreachable via SSH After Time](/news/1441906/ubuntu-server-22-04-unreachable-via-ssh), which covers time synchronization problems that can affect certificate validation. Similarly, if you are using a static IP, check [Ubuntu Server Unreachable Via SSH: Static IP Configuration Issue](/news/1441842/ubuntu-server-ssh-unreachable-with-static-ip) for network layer troubleshooting.

What if I still cannot connect?

If the above steps do not resolve the issue, try connecting with the -o StrictHostKeyChecking=no flag to bypass host key verification errors, though this is less likely to cause permission denied errors. As a last resort, log in locally or via the cloud provider's web console to reset the user password or regenerate the SSH key pair. For general connectivity slowdowns, see [Debugging General Slowdowns and SSH Login Issues on Ubuntu Servers](/news/1401456/debug-slowdowns-ssh-issues-on-ubuntu-servers).

Frequently Asked Questions

Why does SSH say "Permission denied" even with the correct password?

Password authentication is often disabled by default on Ubuntu 22.04 servers for security. You must either enable it in sshd_config or switch to using SSH key-based authentication. Always verify that PasswordAuthentication yes is present and the service is restarted.

Can I log in as root directly?

Most cloud providers disable direct root login via SSH. You should log in as the default user (e.g., ubuntu) and then escalate privileges using sudo su -. Direct root access is considered a security risk and is frequently blocked by default configurations.

How do I check if my SSH key permissions are correct?

Run ls -l ~/.ssh/id_rsa on your local machine. The permissions should be 600 (-rw-------). If they are more permissive, SSH will ignore the key. Use chmod 600 ~/.ssh/id_rsa to fix this.

What if I lost access and cannot log in locally?

Use your cloud provider's rescue console or VNC access to log in directly. Once inside, you can reset permissions, edit sshd_config, or add your new public key to authorized_keys. See [Unable to SSH into Ubuntu Server: Log in Locally First](/news/1374156/ssh-into-ubuntu-server-log-in-locally) for detailed steps.

Does changing the IP address cause permission denied errors?

Changing the IP address does not directly cause permission denied errors, but it may trigger host key verification issues. Clear the old entry in ~/.ssh/known_hosts if you get a "host key verification failed" message. For static IP related issues, refer to our guide on static IP configuration.