SSH Key Authentication Fails With Correct Keys

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

SSH prompts for password even when the correct private key is offered by the client.

Environment & Reproduction

Home directory permissions, authorized_keys mode, or SELinux labels do not meet sshd requirements.

Root Cause Analysis

Run sudo journalctl -u sshd -b and ssh -vvv user@host to inspect rejection reasons.

Quick Triage

Set strict permissions with chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys.

Step-by-Step Diagnosis

Restore SELinux contexts using sudo restorecon -Rv ~/.ssh and verify with ls -Z.

Solution – Primary Fix

Restart daemon with sudo systemctl restart sshd after validating sshd_config.

Solution – Alternative Approaches

Confirm key-based login succeeds and password authentication can remain disabled if desired.

Verification & Acceptance Criteria

Reinstate previous sshd_config backup if new hardening options block legitimate access.

Rollback Plan

Apply user bootstrap scripts to enforce secure SSH permissions and labels consistently.

Prevention & Hardening

Track failed auth counts from journald and alert on unusual spikes by source IP.

Related Errors & Cross-Refs

Use Ansible authorized_key and sefcontext management for consistent account provisioning.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Refer to sshd_config, SELinux SSH policy notes, and RHEL 9 security hardening docs.