Debian 10 – SSH key login fails from bad ~/.ssh permissions – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Public key authentication fails and remote admin access is interrupted.

Environment & Reproduction

Frequent after account restore, home directory copy, or manual chmod/chown.

Root Cause Analysis

OpenSSH rejects keys when file ownership or mode is too permissive.

Quick Triage

Check directory chain and file modes from home to `authorized_keys`.

Step-by-Step Diagnosis

Validate effective config with `sshd -T | grep -i pubkey` and inspect `journalctl -u ssh` entries.

Solution – Primary Fix

Apply strict permissions: `chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys` and correct ownership.

Solution – Alternative Approaches

Temporarily enable password auth under change control for emergency access only.

Verification & Acceptance Criteria

Key login succeeds and logs show accepted publickey authentication.

Rollback Plan

Restore prior sshd configuration backup if new security changes fail.

Prevention & Hardening

Enforce SSH file permission checks in provisioning scripts.

Related Errors & Cross-Refs

Related to disabled `PubkeyAuthentication` or wrong `AuthorizedKeysFile` path.

Related tutorial: View the step-by-step tutorial for debian-10.

View all debian-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian OpenSSH hardening and key management docs.