FreeBSD 13 SSH Public Key Authentication Fails for Valid Keys

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Users are denied key-based login, increasing operational risk and lockouts.

Environment & Reproduction

Often after home directory migration or permission changes.

ssh -vvv user@host

Root Cause Analysis

StrictModes checks fail due to insecure ownership/permissions or wrong key path.

Quick Triage

Inspect sshd logs and effective server auth settings.

sudo tail -n 200 /var/log/auth.log

Step-by-Step Diagnosis

Validate ~/.ssh and authorized_keys perms recursively.

namei -l /home//.ssh/authorized_keys

Solution – Primary Fix

Correct ownership/mode and reload sshd.

sudo chown -R : /home//.ssh && sudo chmod 700 /home//.ssh && sudo chmod 600 /home//.ssh/authorized_keys && sudo service sshd reload

Solution – Alternative Approaches

Use centrally managed authorized keys command backed by directory service.

Verification & Acceptance Criteria

Public key auth succeeds and password fallback policy behaves as expected.

Rollback Plan

Revert to prior sshd_config and key file snapshot.

Prevention & Hardening

Enforce permission baselines with periodic compliance checks.

Related Errors & Cross-Refs

See also host key algorithm negotiation issues.

Related tutorial: View the step-by-step tutorial for freebsd-13.

View all freebsd-13 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

OpenSSH server hardening and troubleshooting guides.