Question

Cannot login with pubkey

Here are steps what i did for ssh key connection:

  1. generated ssh key, the i checked /User/admin/.ssh/ here i have id_rsa, id_rsa.pub and known_hosts.
  2. I copied id_rsa.pub to ~/.ssh/authorized_keys - (I triple checked taht they are the same) (btw i used ssh root@ip)
  3. then i tried to connect to ssh root@ip again. but it doesnt accept the key(password auth method worked after pubkey fail). Ubuntu 18.04.

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Want to learn more? Join the DigitalOcean Community!

Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.

Hello there,

You can check our article on How to Upload an SSH Public Key to an Existing Droplet

https://www.digitalocean.com/docs/droplets/how-to/add-ssh-keys/to-existing-droplet/

You can access the droplet from the DigitalOcean console and then temporary enable the PasswordAuthentication on your droplet and access the droplet with a password to upload the ssh-key.

If you haven’t created new pair of keys you’ll need to do that first.

You can enable PasswordAuthentication for your Droplet by modifying your /etc/ssh/sshd_config file. Once set to Yes restart the SSH service and connect via an SSH client for a more stable connection. You can then modify your ~/.ssh/authorized_keys file to add the appropriate public key.

This change can be made from the DigitalOcean’s console. If you’re having issues accessing the console you can then reach to our amazing support team that can help you further with this.

To enable the PasswordAuthentication follow these steps:

  1. Login to the console on the DigitalOcean website.
  2. Type sudo nano /etc/ssh/sshd_config
  3. Change PasswordAuthentication from “no” to “yes” and save the file
  4. Open a terminal on your computer and type ssh username@[hostname or IP address] or if on a Windows box use PuTTY for password login making sure authentication parameters aren’t pointing to a private key
  5. Login with a password
  6. Type sudo nano ~/.ssh/authorized_keys
  7. Paste public key text here and save the file
  8. Type sudo nano /etc/ssh/sshd_config
  9. Change PasswordAuthentication from “yes” to “no” and save the file
  10. Log out and attempt to log back in (if using PuTTY make sure you set up auth parameters to point to your private key)

You can then upload the key using this command:

ssh-copy-id -i ~/.ssh/mykey user@droplet

Hope that this helps! Regards, Alex

Hey friend!

That is interesting. The good news is that you can limit your scope of thought on this to a fairly small set of items. There’s only so much that can go wrong here. Try this:

ssh -vvv root@IP

See if you get anything in the output that tries to explain the failures. Maybe it couldn’t load id_rsa, for example, and advises on permission changes. Seems unlikely to have permission issues though if you used ssh-keygen. So glance at that but if you see nothing, let’s move on.

Double check that the items in /root/.ssh/authorized_keys are valid. One key per line, no line breaks, no weird spaces. Your key should look something like mine:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDLmqjzH1lJ+uTlL2yGjyOcFKdxYFWYLSUdqN5LMRA1YiXHJvTkOo4Ky8w8NmNqJoKwLhxESLNpdUteZbacCRf3I9j57td8IaySk3LFpNK1waDwPcwFlvOv6NtKdwFsgQ0CUqJ6Ya9AUVfTlyePBhH9lKy7gnsloAtHOfGlHdCt5X5f2iB0WU/PPZZskfj79z84dlUPrdfdq8DZmOQDnTEF6XnqaYIqrYXKnPOTovCnOGrc1xJjV+UQ7dZhc/5UCECDK8DEUKZ21aK5htCwhqQFLVV4M6SB7/mDiWXvNx79hKuHDHsHCv6L4YuqHkHAGNtmHq2UxntJ9K6i0DxoMq/1 jarlanddonnell@Jarlands-iMac.local

Also unlikely that key login is disabled on the droplet, so I’m kind of thinking you may find something there in authorized_keys.

Jarland