How to fix "Permission denied (publickey)" on SSH

"Permission denied (publickey)" means the SSH server only accepts key authentication and none of the keys your client offered matched. The server is reachable and running; the problem is the key, the user name, or file permissions on the server. Here is how to find which.

Before you start

• The user name, host, port and private key you are using.
• For a VPS, access to the VNC console in your control panel in case you need to fix the server side.
• For cPanel SSH, access to cPanel → Security → SSH Access.

See what SSH is doing

Run the connection in verbose mode:

ssh -v -i ~/.ssh/id_ed25519 -p 22 user@server-ip

Look for Offering public key lines (which keys are tried) and Server accepts key. If your key is never offered, the client side is the problem.

Fix the client side

1. Use the right key with -i, or set it in ~/.ssh/config with IdentityFile and IdentitiesOnly yes.
2. Use the right user name. On cPanel it is your cPanel username, not root. On cloud images it may be ubuntu or debian.
3. Fix private key permissions: chmod 600 ~/.ssh/id_ed25519. SSH ignores keys readable by others.
4. PuTTY users: convert the key to .ppk with PuTTYgen and load it under Connection → SSH → Auth.

Fix the server side

1. Check the key is installed. The public key must be on one line in ~/.ssh/authorized_keys of the user you log in as. On cPanel, import it in SSH Access → Manage SSH Keys and click Authorize.
2. Fix permissions and ownership:
   Copy

   chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys && chown -R $USER:$USER ~/.ssh

   The home directory must not be group- or world-writable either.
3. Check sshd settings in /etc/ssh/sshd_config: PubkeyAuthentication yes, and PermitRootLogin allows keys if you log in as root. Test with sshd -t, then restart SSH.
4. Read the server log: journalctl -u ssh -n 50 (or sshd) often says "bad ownership or modes".

FAQ

Can I log in with a password instead?

Only if PasswordAuthentication is enabled on the server. Keys are safer.

Why did my key stop working after an update?

Newer OpenSSH versions reject old ssh-rsa SHA-1 signatures. Generate an Ed25519 key.

How do I add a key if I am locked out of my VPS?

Use the VNC console with the root password and add the key to authorized_keys.

Next steps

• SSH connection refused or timed out
• Linux permission denied errors
• VPS not booting