Debian 12 SSH Public Key Authentication Denied

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

SSH key logins fail, causing administrative lockout risk for remote systems.

Environment & Reproduction

Usually appears after key rotation, user home permission changes, or sshd policy hardening.

Root Cause Analysis

Key mismatch, wrong ownership, or restrictive sshd configuration blocks public key acceptance.

Quick Triage

Maintain console access path and avoid disabling password auth until key path is verified.

Step-by-Step Diagnosis

Use ssh -vvv and server auth logs to confirm offered key and server-side rejection reason.

Solution – Primary Fix

Install correct public key, fix file permissions, validate sshd_config, and reload ssh service.

Solution – Alternative Approaches

Use TrustedUserCAKeys or centrally managed SSH certificates for controlled key distribution.

Verification & Acceptance Criteria

Key-based login succeeds from approved hosts and password fallback policy matches security baseline.

Rollback Plan

Revert sshd configuration to previous known-good state and restore prior authorized_keys backup.

Prevention & Hardening

Automate key deployment and permission checks with configuration management and CI validations.

Related Errors & Cross-Refs

Permission denied publickey; authentication refused bad ownership or modes; no mutual signature supported.

Related tutorial: View the step-by-step tutorial for debian-12.

View all debian-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

OpenSSH manuals, Debian hardening guide, and key management operational best practices.