Ubuntu 26.04 LTS – OpenSSH denies key auth after hardening changes

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Administrators observe: Ubuntu 26.04 LTS – OpenSSH denies key auth after hardening changes. Remote administration access is interrupted.

Environment & Reproduction

Issue appears after edits to sshd_config, file permissions, or authorized_keys paths.

# Baseline context
lsb_release -a
sudo sshd -t
systemctl status ssh --no-pager
sudo journalctl -u ssh -n 120 --no-pager
namei -l ~/.ssh ~/.ssh/authorized_keys

Root Cause Analysis

StrictModes checks and incorrect auth settings can cause valid keys to be rejected.

Quick Triage

Validate sshd effective configuration and key file permissions.

# Quick triage
sudo sshd -T | grep -E 'pubkeyauthentication|passwordauthentication|authorizedkeysfile|permitrootlogin'
ls -ld ~/.ssh
ls -l ~/.ssh/authorized_keys
chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys

Step-by-Step Diagnosis

Run sshd in debug mode on alternate port and capture authentication path.

# Detailed diagnosis
sudo /usr/sbin/sshd -ddd -p 2222 -f /etc/ssh/sshd_config
# From client: ssh -vvv -p 2222 user@host
sudo journalctl -u ssh --since '1 hour ago' --no-pager

Solution – Primary Fix

Correct sshd settings and ownership/permissions, then reload service.

# Primary fix
sudoedit /etc/ssh/sshd_config
# Ensure: PubkeyAuthentication yes
# Ensure: AuthorizedKeysFile .ssh/authorized_keys
sudo chown -R $USER:$USER ~/.ssh
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
sudo systemctl reload ssh

Solution – Alternative Approaches

Use Match blocks carefully and test with include file overrides before global changes.

# Alternative
sudo mkdir -p /etc/ssh/sshd_config.d
sudoedit /etc/ssh/sshd_config.d/90-hardening.conf
sudo sshd -t && sudo systemctl reload ssh

Verification & Acceptance Criteria

Key-based login succeeds from approved admin hosts and logs show accepted publickey.

# Verify
ssh -i ~/.ssh/id_ed25519 -o PreferredAuthentications=publickey user@host 'id'
sudo journalctl -u ssh -n 80 --no-pager | grep -Ei 'Accepted publickey|Failed publickey'

Rollback Plan

Restore last known-good sshd configuration from backup and reload immediately.

# Rollback
sudo cp -a /etc/ssh/sshd_config.bak /etc/ssh/sshd_config
sudo sshd -t && sudo systemctl reload ssh

Prevention & Hardening

Validate sshd changes with syntax tests and staged rollout before enforcement.

# Hardening
sudo sshd -t
sudo apt-get install -y openssh-server
sudo journalctl -u ssh --since '24 hours ago' --no-pager | grep -Ei 'failed|invalid|error' || true

Related Errors & Cross-Refs

Related patterns include permission denied (publickey), bad ownership or modes, and auth method disabled by policy.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

OpenSSH server manual and Ubuntu SSH security documentation.