Production Security
SSH Permission Denied Debugging Guide
Debug SSH public-key authentication failures by checking the selected identity, server policy, file ownership and authorization logs in a safe order. This reference is written for developers who need practical validation behavior, reviewable rules and safe examples rather than copied snippets with no explanation.
Recommended workflow
| Step | Why it matters |
|---|---|
| Confirm the target | Verify hostname, port and remote username before changing keys. |
| Inspect client selection | Use verbose output to see which identities the client offers and which configuration block applies. |
| Check server authorization | Review authorized_keys ownership, permissions and key restrictions from an existing trusted session. |
| Read authentication logs | Use the server log to distinguish rejected algorithms, policy failures and unreadable key files. |
Starter snippet
ssh -vvv user@hostReview checks
- Keep a working administrative session open while testing.
- Prefer dedicated keys per automation boundary.
- Verify the host key before accepting changes.
- Remove obsolete authorized keys after recovery.
Common mistakes
- Regenerating every key before reading verbose output.
- Disabling host-key verification to hide a mismatch.
- Making .ssh writable by unrelated users.
Validation should help users correct input while protecting systems from bad data. Keep syntax checks, product policy, security review and deliverability checks separate.
Related Formalint references
Continue with Linux Admin Command Guide, Linux Journalctl Guide, Secrets Redaction Checklist.