The "Putty Fatal Error: Server Refused Key Connection" on Oracle Cloud typically occurs because the SSH client is using an incorrect private key file or the public key was not correctly registered in the cloud instance's authorized keys. This authentication failure prevents the handshake from completing, resulting in an immediate rejection by the server before any session can be established.
Understanding the Authentication Mismatch
When you attempt to connect to an Oracle Cloud Infrastructure (OCI) Compute instance via PuTTY, the software acts as an SSH client. The error message indicates that the server has received your connection request but refuses the specific credentials provided. In the context of SSH, this almost always points to a mismatch between the private key file you are presenting and the public key stored on the remote server.
Oracle Cloud instances often generate a default key pair during provisioning. If you are trying to use a different key, or if the key file format is incompatible, the server will reject the attempt. It is crucial to verify that the private key you are loading into PuTTY corresponds exactly to the public key associated with the OCI compartment and the specific compute instance.
Converting Keys for PuTTY Compatibility
One of the most common causes of this error is using a standard OpenSSH private key file directly within PuTTY. PuTTY uses its own proprietary format called PPK (PuTTY Private Key), whereas modern Linux systems and Oracle Cloud typically generate keys in the OpenSSH PEM format. If you try to load a raw
.pem or
.ppk file without converting it first, PuTTY may fail to parse it correctly, leading to authentication errors.
To resolve this, you must convert your existing OpenSSH private key into the PPK format. You can do this using the PuTTYgen tool, which is installed alongside PuTTY on Windows systems. Follow these steps to ensure compatibility:
- Open PuTTYgen from your Start menu.
- Click the Load button and select your original private key file (usually ending in
.pem or .key).
- If prompted about the passphrase, enter it if you set one; otherwise, leave it blank.
- Once loaded, click Save private key.
- Save the new file with a
.ppk extension.
After saving the converted key, go back to your PuTTY session configuration. In the left-hand tree menu, navigate to
Connection >
SSH >
Auth. Under the "Private key file for authentication" field, browse and select the newly created
.ppk file. Ensure that no other key files are selected in this list, as having multiple conflicting keys can sometimes cause the client to present the wrong one.
Plink Access Granted: Nothing Occurs Even with Correct Credentials? explores similar credential handling issues when using command-line SSH tools, which can provide further insight into how clients manage key selection.
Verifying OCI Instance Configuration
Even with the correct key file, the server-side configuration must allow the key for login. Oracle Cloud instances rely on the
~/.ssh/authorized_keys file on the remote machine. When you launch an instance via the OCI Console, you usually specify a key pair. If you did not upload a custom public key, OCI generates a default one.
You must ensure that the public key corresponding to your private key is actually present in the
authorized_keys file of the user account you are trying to access (typically
opc or
root). If you recently changed the key pair in the OCI console, the old keys may have been removed, or the new public key may not have propagated to the instance yet.
If you suspect the key is missing from the server, you may need to access the instance through the OCI Serial Console or VNC if available, to manually append the public key to the
authorized_keys file. This step requires direct access to the operating system and bypasses the network SSH layer entirely.
Checking Network and Security List Rules
While less common for this specific error message, network security lists can sometimes interfere with the initial handshake. Ensure that your Virtual Cloud Network (VCN) allows inbound traffic on port 22 (SSH) from your IP address. However, note that if the connection were blocked by a firewall, you would typically see a timeout or "Connection refused" due to network unreachability, rather than a key refusal. The key refusal confirms that the packet reached the SSH daemon, but the cryptographic exchange failed.
For users experiencing broader connectivity issues, such as hangs or drops, reviewing general SSH troubleshooting guides can help isolate whether the problem is local or network-wide. See
Troubleshooting SSH Client Connection Hangs at Start for diagnostics on persistent connection states.
Common Pitfalls and Final Checks
Always double-check the username. On Oracle Cloud Linux images, the default administrative user is
opc, not
root or
ubuntu. Using the wrong username can lead to permission denied errors that might be misinterpreted as key failures if the key is not mapped to that specific user. Additionally, ensure that the line endings of your key file are correct; Windows-style CRLF line endings in a Linux key file can sometimes cause parsing issues in older SSH implementations.
If you continue to face issues, consider generating a fresh key pair via PuTTYgen, uploading the new public key to the OCI instance metadata, and testing the connection again. This isolates whether the issue lies with the key generation process or the cloud infrastructure itself.
Frequently Asked Questions
Why does PuTTY say "Server refused key" even though I uploaded the correct key?
This usually happens because the key file format is incompatible. PuTTY requires the PPK format, while Oracle Cloud provides keys in OpenSSH PEM format. You must convert the key using PuTTYgen before loading it into the PuTTY session settings.
Can I use the same key file for PuTTY and command-line SSH?
No, not directly. Command-line SSH tools expect OpenSSH format keys, while PuTTY expects PPK format. You can keep both formats by keeping the original
.pem file for CLI use and saving the converted
.ppk file specifically for PuTTY.
What should I do if I lost my private key for an Oracle Cloud instance?
You cannot recover the private key if it is lost. You must generate a new key pair, upload the new public key to the instance (via serial console or VNC if necessary), and then use the new private key to connect. The old key will remain valid until replaced.
Does the SSH port number affect key authentication?
The port number does not affect the cryptographic key exchange itself, but if you are using a non-standard port (not 22), you must configure PuTTY to connect to that specific port under the Session settings. The key refusal error still applies regardless of the port, as long as the SSH service is reachable.
How can I verify if my key is in the authorized_keys file?
If you have access to the instance via another method like VNC or serial console, log in and run
cat ~/.ssh/authorized_keys. Compare the content with the public portion of your key. If it is missing, append it using
echo "your_public_key" >> ~/.ssh/authorized_keys.