RHEL 7 SSH login denied due to key permissions and SELinux context

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Users with valid SSH keys are rejected and fall back to passwords or lose access entirely. Operational support load rises and automation jobs depending on key auth fail.

Environment & Reproduction

Common after home directory migration, backup restore, or manual permission edits. Reproduce by setting permissive file modes or incorrect SELinux contexts on .ssh and authorized_keys.

Root Cause Analysis

OpenSSH enforces strict ownership and mode checks, while SELinux labels gate file access for sshd. Even with correct keys, bad modes or labels trigger authentication denial events.

Quick Triage

Inspect ~/.ssh permissions, ownership, and contexts with ls -laZ. Check sshd logs using journalctl -u sshd -xe and audit AVC entries. Confirm sshd configuration has expected auth settings.

Step-by-Step Diagnosis

Validate key path, mode, and ownership for user home and .ssh files, then correlate denial messages in journalctl and audit logs. Confirm SELinux context drift after migrations.

Solution – Primary Fix

Set strict permissions (700 for .ssh, 600 for authorized_keys), correct ownership, run restorecon -Rv on user paths, and restart sshd via systemctl or service sshd restart if required.

Solution – Alternative Approaches

Use centralized key management, deploy context fixes through automation, or temporarily permit password auth for emergency access with immediate post-incident rollback and audit.

Verification & Acceptance Criteria

Key-based login must succeed for affected users, and journalctl should show clean publickey acceptance. No new SELinux AVC denials should appear for sshd during test logins.

Rollback Plan

If access degrades further, restore previous sshd_config and authorized_keys backups, then restart service. Preserve before/after file metadata for forensic and compliance records.

Prevention & Hardening

Enforce SSH file mode checks in CI for user provisioning, run periodic restorecon audits, and keep SELinux enforcing. Restrict firewalld SSH exposure to approved source ranges.

Related Errors & Cross-Refs

Related messages include Authentication refused: bad ownership or modes and SELinux avc: denied for sshd_t. Cross-reference user home mount options and identity management tooling.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Consult sshd, sshd_config, and SELinux troubleshooting documentation. Add standardized SSH remediation steps to runbooks for both systemctl and service command environments.