Error Permission denied (publickey) when I try to ssh

I would like to discourage people from enabling PasswordAuthentication because it’s less secure than using an ssh key. Here is the answer you’re most likely looking for.

Short Answer: As Root, run the following commands after creating the user:

1. cp -r ~/.ssh /home/{new_user}/
2. sudo chown -R {new_user}:{new_user} /home/{new_user}/.ssh

This is basically copying over the ssh key from the root user to the new user, which I would assume the new user is for you so you won’t have to login as root. If the new user is for someone else you can either create an ssh public key for them and give it to them or have them give you their existing ssh public key and place it in their /home/{new_user}/.ssh directory.

I would like to discourage people from enabling PasswordAuthentication because it’s less secure than using an ssh key. Here is the answer you’re most likely looking for.

Short Answer: As Root, run the following commands after creating the user:

1. cp -r ~/.ssh /home/{new_user}/
2. sudo chown -R {new_user}:{new_user} /home/{new_user}/.ssh

This is basically copying over the ssh key from the root user to the new user, which I would assume the new user is for you so you won’t have to login as root. If the new user is for someone else you can either create an ssh public key for them and give it to them or have them give you their existing ssh public key and place it in their /home/{new_user}/.ssh directory.

Thank you, thank you thank you! I read this answer like a week ago, let it digest and now I followed your instructions and it worked like a charm!

When trying to ssh into my droplet I got this error “root@XXX.XXX.XXX.XXX: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).”

My issue was that I use ssh to log into various servers (git, bitbucket and other servers). I was able to resolve my problem by adding an entry to my ~/.ssh/config file.

vim ~/.ssh/config

Host XXX.XXX.XXX.XXX
  IdentityFile ~/.ssh/id_rsa

Where,
XXX.XXX.XXX.XXX = droplet IP
id_rsa = the ssh key file you use

To me, works changing (Ubuntu 18.04):

sudo nano /etc/ssh/sshd_config
PermitRootLogin prohibit-password to PermitRootLogin yes 
PasswordAuthentication no to PasswordAuthentication yes

then, restart ssh service:

sudo service ssh restart

Thanks!

I had the same issue and fixed it by updating the SSH config file on my local machine.

First:

nano ~/.ssh/config

Then add these lines:

Host [your droplet ip]
  UseKeychain yes
  AddKeysToAgent yes
  IdentityFile ~/.ssh/[your private key file]

That’s it.

The issue is within your sshd_config file.

Here is the ULTIMATE solution to this issue:

1. Log as root to your Ubuntu server

2. Use vim or nano to edit the contents of /etc/ssh/sshd_config Eg. vi /etc/ssh/sshd_config or nano /etc/ssh/sshd_config

3. Now go to the very bottom of the file (to the line with PasswordAuthentication) - Change the value next to PasswordAuthentication from no to yes. It should now look like this:

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication yes

4. Save the file and then run the following command to reload the SSH config: sudo service sshd reload

With this done, you can now set up your new SSH key for your LOCAL device. To do this, you can run the following from your LOCAL device, not the server:

ssh-copy-id username@droplet.ip

(Make sure to replace username with your username on the droplet and droplet.ip with the full IP address of your droplet)

With this done, you should be good to go, connecting with SSH keys!

The issue is within your sshd_config file.

Here is the ULTIMATE solution to this issue:

1. Log as root to your Ubuntu server

2. Use vim or nano to edit the contents of /etc/ssh/sshd_config Eg. vi /etc/ssh/sshd_config or nano /etc/ssh/sshd_config

3. Now go to the very bottom of the file (to the line with PasswordAuthentication) - Change the value next to PasswordAuthentication from no to yes. It should now look like this:

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication yes

4. Save the file and then run the following command to reload the SSH config: sudo service sshd reload

With this done, you can now set up your new SSH key for your LOCAL device. To do this, you can run the following from your LOCAL device, not the server:

ssh-copy-id username@droplet.ip

(Make sure to replace username with your username on the droplet and droplet.ip with the full IP address of your droplet)

With this done, you should be good to go, connecting with SSH keys!

The issue is within your sshd_config file.

Here is the ULTIMATE solution to this issue:

1. Log as root to your Ubuntu server

2. Use vim or nano to edit the contents of /etc/ssh/sshd_config Eg. vi /etc/ssh/sshd_config or nano /etc/ssh/sshd_config

3. Now go to the very bottom of the file (to the line with PasswordAuthentication) - Change the value next to PasswordAuthentication from no to yes. It should now look like this:

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication yes

4. Save the file and then run the following command to reload the SSH config: sudo service sshd reload

With this done, you can now set up your new SSH key for your LOCAL device. To do this, you can run the following from your LOCAL device, not the server:

ssh-copy-id username@droplet.ip

(Make sure to replace username with your username on the droplet and droplet.ip with the full IP address of your droplet)

With this done, you should be good to go, connecting with SSH keys!

The issue is within your sshd_config file.

Here is the ULTIMATE solution to this issue:

1. Log as root to your Ubuntu server

2. Use vim or nano to edit the contents of /etc/ssh/sshd_config Eg. vi /etc/ssh/sshd_config or nano /etc/ssh/sshd_config

3. Now go to the very bottom of the file (to the line with PasswordAuthentication) - Change the value next to PasswordAuthentication from no to yes. It should now look like this:

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication yes

4. Save the file and then run the following command to reload the SSH config: sudo service sshd reload

With this done, you can now set up your new SSH key for your LOCAL device. To do this, you can run the following from your LOCAL device, not the server:

ssh-copy-id username@droplet.ip

(Make sure to replace username with your username on the droplet and droplet.ip with the full IP address of your droplet)

With this done, you should be good to go, connecting with SSH keys!