Permission denied (publickey) error

Quick answer: "Permission denied (publickey)" means the SSH connection works but the server rejected your authentication — wrong username, wrong key, bad authorized_keys permissions, or password login disabled. Verify the user and key with ssh -v, and use the KVM Console to repair keys if you are locked out.

Overview

This error comes from the server's SSH policy, not the network. If the server offers only publickey authentication and your client has no matching key, you get this message even with a perfectly correct password.

Before you start

• The correct username (root on most Linux templates; shown on the service page).
• The private key you expect to work, and Client Area access for the console fallback.

Step-by-step guide

1. Run verbose SSH and watch which keys are offered:

   ssh -v -i ~/.ssh/id_ed25519 root@YOUR_SERVER_IP

   Lines like Offering public key and Authentications that can continue tell you what the server accepts.
2. Confirm the username — ubuntu, debian or root differ between images; the service page shows the right one.
3. If the key should work, check it is the pair of the public key on the server. On the server (via KVM Console if needed):

   cat ~/.ssh/authorized_keys

4. Fix permissions — SSH silently ignores keys that are too open:

   chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys

5. If you need password login temporarily, enable it in /etc/ssh/sshd_config (PasswordAuthentication yes), then

   sudo systemctl reload sshd

   and disable it again once keys are fixed.

Common issues

• Wrong key file: the client offers id_rsa while the server knows id_ed25519 — pass -i explicitly.
• Copied the private key to the server instead of the public one — authorized_keys must contain lines starting with ssh-ed25519/ssh-rsa.
• Home directory permissions too open (e.g. 777) — sshd refuses the whole chain.
• root login disabled (PermitRootLogin no) — log in as the regular user and use sudo.

When to contact support

If you cannot reach the server via the KVM Console to repair keys, or the console password from the service page is also rejected, open a ticket — include the full ssh -v output.

Frequently asked questions

Why does the server refuse my password and mention publickey?

Password authentication is disabled in sshd_config, so the server accepts only key-based logins. Use the correct private key, or re-enable PasswordAuthentication temporarily via the KVM Console.

Which file permissions does SSH require for keys?

The .ssh directory must be 700 and authorized_keys 600, owned by the login user. If permissions are more open than that, sshd silently ignores the keys and authentication fails.

Related articles

• How to set up SSH keys
• Cannot connect via SSH
• How to connect to VPS via SSH
• What information to include in a support ticket

Need a hand? Contact Cloud2Y support →