SSH Permission Denied with Correct Password - Public Key

SSH permission denied errors with correct passwords usually stem from misconfigured server-side authentication settings, incorrect file permissions on the .ssh directory, or using the wrong username. Verifying that PasswordAuthentication is enabled in /etc/ssh/sshd_config and ensuring the private key has strict read-only permissions for the owner are the most effective first steps to resolve this connectivity issue.

Understanding Authentication Methods

The SSH protocol supports several methods for verifying identity, including public key authentication, password authentication, and keyboard-interactive modes. When you encounter a "Permission Denied" message despite entering the correct credentials, the server is likely rejecting the method you are attempting to use. By default, many modern Linux distributions disable password authentication in favor of more secure public key exchanges to mitigate brute-force attacks. If your client is configured to try password authentication but the server has disabled it, the connection will fail immediately. Conversely, if you are trying to use a key but the server expects a password, or vice versa, the handshake will not complete successfully. It is crucial to understand which method your server administrator has permitted. You can often see the available methods by running the SSH command with verbose output, which reveals exactly where the negotiation fails.

Checking Server Configuration

To determine if password authentication is allowed, you must inspect the SSH daemon configuration file on the remote server. This file is typically located at /etc/ssh/sshd_config. Look for the line containing PasswordAuthentication. If it is set to no, you cannot log in with a password regardless of its correctness. You may need to change this to yes and restart the SSH service, or better yet, set up public key authentication which is more secure. Another common setting is PubkeyAuthentication. If this is disabled, you must rely on passwords or other methods. Ensure that both relevant authentication types are aligned with your intended login strategy. After making any changes to sshd_config, remember to reload the service using sudo systemctl reload sshd to apply the new rules without dropping existing connections.

File Permissions and Ownership

SSH is extremely strict about file permissions for security reasons. If the permissions on your home directory, the .ssh folder, or the authorized keys file are too open, the SSH daemon will ignore them entirely to prevent unauthorized access. This is a frequent cause of silent failures where the server refuses to recognize valid keys or passwords due to perceived security risks. Your home directory should generally have permissions set to 755 or stricter. The .ssh directory inside your home folder must be 700, meaning only the owner can read, write, or execute files within it. The authorized_keys file, which contains the public keys allowed to log in, must have permissions of 600. If these permissions are loose, such as 644 or 777, the SSH server will reject the authentication attempt. You can correct these permissions using the following commands on the server:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chown -R $USER:$USER ~/.ssh

Ensure that the ownership matches the user account you are logging into. Incorrect ownership can also lead to permission denied errors, even if the numeric permissions are correct.

Username and Host Key Verification

Sometimes the issue is not with the password or key itself, but with the identifier used to reach the server. Ensure you are specifying the correct username in the SSH command, such as ssh username@host. Using root when the server disables root login via SSH will result in immediate rejection. Additionally, check if the server requires a specific port other than the default 22. Host key verification issues can also mimic permission denied errors. If the server's host key has changed, perhaps due to a reinstall or IP rotation, your client will refuse the connection to prevent man-in-the-middle attacks. You can clear the old key from your known_hosts file or connect with -o StrictHostKeyChecking=no for testing purposes, though this is not recommended for production environments. For advanced troubleshooting involving network tunnels, such as accessing internal services securely, consider reviewing how to establish a Secure VNC Screensharing Connection Mac (Client) Windows 10 (Server) via SSH Tunnel to ensure your tunneling configurations are not interfering with direct SSH access.

Detailed Diagnostic Steps

When standard fixes do not work, enabling verbose mode provides critical insight into the failure point. Run your SSH command with the -v flag, or multiple vs for more detail, like ssh -vvv user@host. The output will show each step of the authentication process, indicating whether the server offered password auth, rejected your key, or failed due to policy restrictions. Look for lines indicating "Authentications that can continue" and "Next authentication method". If you see "publickey" listed but you are trying a password, the server is ignoring your password attempt. If no methods are listed, there may be a broader connectivity or firewall issue blocking the SSH port. In cases where you need to expose local resources through such connections, understanding the underlying transport layer is vital, similar to how one would Expose Local Server on VPS Preserving Real Client IPs (OS Level) while maintaining secure channels. Finally, check the server-side logs for detailed error messages. On most Linux systems, these are found in /var/log/auth.log or /var/log/secure. These logs often provide specific reasons for rejection, such as invalid user, bad permissions, or expired certificates, guiding you toward the precise fix needed.

Frequently Asked Questions

Why does SSH say permission denied even with the right key?

This usually happens because the authorized_keys file or the .ssh directory has permissions that are too permissive, such as world-readable. The SSH daemon ignores keys in insecure directories to protect against theft. Fix this by setting the directory to 700 and the keys file to 600.

How do I enable password authentication on a Linux server?

Edit the /etc/ssh/sshd_config file on the server and set PasswordAuthentication yes. You must then restart or reload the SSH service for the change to take effect. Note that this reduces security compared to key-based authentication.

Can I use SSH to connect to a MariaDB socket remotely?

Yes, you can tunnel database connections over SSH to avoid exposing TCP ports. This involves mapping a local socket file to a remote one via an SSH connection, allowing secure database access without opening the firewall. For details on this setup, see our guide on Connecting to Remote MariaDB using SSH and Socket File (No TCP).

What if I forgot the SSH password and can't reset it?

If you cannot authenticate, you will likely need console access to the server, such as through a cloud provider's web console or physical access. From there, you can reset the user password using the passwd command or modify the SSH config to allow key-only login temporarily.

Does TLS encryption affect SSH permission denied errors?

No, TLS is a different protocol used by HTTPS and cURL, whereas SSH uses its own encryption layer. However, if you are mixing tools, ensure you are not confusing SSH keys with TLS certificates. Issues with unknown CAs in TLS, for example, are distinct from SSH authentication failures. See Make cURL establish TLS connection with CA unknown for related networking concepts.