RHEL 10 – SSH public key login denied by SELinux context mismatch – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Users cannot log in with SSH keys and automation workflows fail.

Environment & Reproduction

Happens after moving home directories or copying files with wrong context.

ssh user@host

Root Cause Analysis

authorized_keys has incorrect SELinux context, so sshd cannot read it under enforcing mode.

Quick Triage

Check SELinux mode and key file labeling.

getenforce
ls -lZ /home/user/.ssh

Step-by-Step Diagnosis

Inspect audit logs for AVC denials tied to sshd.

ausearch -m avc -ts recent | grep sshd
journalctl -u sshd -n 100

Solution – Primary Fix

Restore SELinux context and file permissions for .ssh content.

sudo restorecon -Rv /home/user/.ssh
chmod 700 /home/user/.ssh
chmod 600 /home/user/.ssh/authorized_keys

Solution – Alternative Approaches

Use semanage fcontext for non-standard home path layouts.

sudo semanage fcontext -a -t ssh_home_t '/data/home(/.*)?'

Verification & Acceptance Criteria

Public key authentication succeeds under SELinux enforcing mode.

ssh -o PreferredAuthentications=publickey user@host
sestatus

Rollback Plan

Undo custom fcontext entries if they cause broader access failures.

sudo semanage fcontext -d '/data/home(/.*)?'

Prevention & Hardening

Automate context restoration after migrations and keep SELinux enforcing.

Related Errors & Cross-Refs

Related to strict mode permission errors and denied PAM home directory access.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

SELinux user home and SSH policy references for RHEL.