LightAtom

"Permission Denied (publickey)": How to Fix SSH Keys

The SSH server only accepts key-based login and none of the keys your client offered matched. Usually the wrong key, a key not loaded into the agent, or bad permissions.

Permission denied (publickey)

The server accepts only SSH keys, and none of the keys your Mac offered is in the server's list of allowed keys for that user.

Quick checks

  • Check the user name: `git@github.com`, `ubuntu@…`, `ec2-user@…` are all different.
  • Run `ssh -v user@host` and read which keys are offered.
  • For GitHub, run `ssh -T git@github.com`.

Fixes on Mac

  1. See what ssh is doing

    1. Run ssh -v user@host. Look for lines like Offering public key: …/id_ed25519 and Authentications that can continue: publickey.
    2. If your key is never offered, ssh can't find it or the agent doesn't have it.

  2. Load the key and keep it in the keychain

    1. Run ssh-add --apple-use-keychain ~/.ssh/id_ed25519 (enter the passphrase once).
    2. Add to ~/.ssh/config: Host * with AddKeysToAgent yes, UseKeychain yes and IdentityFile ~/.ssh/id_ed25519, so it's loaded automatically.

  3. Use the right key for each host

    1. In ~/.ssh/config, set IdentityFile per Host block, and IdentitiesOnly yes if you have many keys (servers stop after a few failed offers).

  4. Fix permissions

    1. chmod 700 ~/.ssh and chmod 600 ~/.ssh/id_ed25519 ~/.ssh/config. ssh ignores private keys that others can read.

Fixes on Windows

  1. OpenSSH on Windows

    1. Start the agent service (Get-Service ssh-agent | Set-Service -StartupType Automatic; Start-Service ssh-agent), then ssh-add.

Other devices

  1. On the server

    1. Your public key must be in ~/.ssh/authorized_keys of the user you log in as, one line per key.
    2. Permissions: ~/.ssh 700, authorized_keys 600, and the home directory not group-writable.

Still not working?

If keys look right, check the server's auth log (/var/log/auth.log or journalctl -u ssh) for the reason, such as “bad ownership or modes”. Cloud providers may also need the key added through their console rather than by editing files.

See what’s happening

LightAtom's connections view shows the SSH connection from your Mac to the host on port 22, so you can confirm you're reaching the right server.

Frequently asked questions

What does Permission denied (publickey) mean?

The server allows only public-key authentication, and none of the keys your client offered is authorised for that user. Passwords aren't being accepted.

How do I fix Permission denied (publickey) for GitHub?

Add your public key (~/.ssh/id_ed25519.pub) in GitHub › Settings › SSH and GPG keys, load the private key with ssh-add, and test with ssh -T git@github.com.

How do I make my Mac remember the SSH key passphrase?

Run ssh-add --apple-use-keychain ~/.ssh/id_ed25519 once, and put UseKeychain yes and AddKeysToAgent yes in ~/.ssh/config.

Why does ssh say “Too many authentication failures”?

The agent offered too many keys before the right one. Set IdentityFile and IdentitiesOnly yes for that host in ~/.ssh/config.

Related errors and tools

Related

LightAtom team

The people who build LightAtom, a network monitor for macOS.