Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my local machine I have a public key stored in


To be able to log in to a remote machine I copy this key using ssh-copy-id:

ssh-copy-id user@remote-host

On the remote host, I see two lines added to the file .ssh/authorized_keys starting with ssh-dss and ssh-rsa, and ending with the local machine information.

However, when I now log in to the remote machine with

ssh user@remote-host

I am still asked for a password. Why is that and how can this be fixed?

  • The file permissions of authorized_keys are correct.
  • The following is the result of ssh -v:

    OpenSSH_5.9p1 Debian-5ubuntu1.1, OpenSSL 1.0.1 14 Mar 2012 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: Applying options for * debug1: Connecting to xxx [xxx] port 22. debug1: Connection established. debug1: identity file /home/alexander/.ssh/id_rsa type 1 debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048 debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048 debug1: identity file /home/alexander/.ssh/id_rsa-cert type -1 debug1: identity file /home/alexander/.ssh/id_dsa type 2 debug1: Checking blacklist file /usr/share/ssh/blacklist.DSA-1024 debug1: Checking blacklist file /etc/ssh/blacklist.DSA-1024 debug1: identity file /home/alexander/.ssh/id_dsa-cert type -1 debug1: identity file /home/alexander/.ssh/id_ecdsa type -1 debug1: identity file /home/alexander/.ssh/id_ecdsa-cert type -1 debug1: Remote protocol version 2.0, remote software version dropbear_0.52 debug1: no match: dropbear_0.52 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.1 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: sending SSH2_MSG_KEXDH_INIT debug1: expecting SSH2_MSG_KEXDH_REPLY debug1: Server host key: RSA XXXX debug1: Host 'remote_host' is known and matches the RSA host key. debug1: Found key in /home/alexander/.ssh/known_hosts:26 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,password debug1: Next authentication method: publickey debug1: Offering DSA public key: /home/alexander/.ssh/id_dsa debug1: Authentications that can continue: publickey,password debug1: Offering RSA public key: /home/alexander/.ssh/id_rsa debug1: Authentications that can continue: publickey,password debug1: Trying private key: /home/alexander/.ssh/id_ecdsa debug1: Next authentication method: password user@remote_host's password:

share|improve this question
The log only says that your client has offered the key to the server, but apparently the server didn't accept that, so it reverts to password authentication. the reasons for tjat should be on server side, maybe PubkeyAuthentication or AuthorizedKeysFile aren't set on the server? – mauro.stettler Nov 8 '13 at 9:15
Permissions on authorized_keys file on remote host? – Jiri Xichtkniha Nov 8 '13 at 9:20
The permissions on the authorized_keys are correct, and unfortunately I have no log files available I can take a look (because the remote host runs a non-standard linux and is highly configured.). Which file(s) usually contain ssh settings? – Alex Nov 8 '13 at 9:34
I have found the error: The modes of the overlaying directories where incorrect! After fixing all the permissions and ownerships the passwordless ssh login works. Thanks for the suggestions. – Alex Nov 8 '13 at 9:52

You will need to cat out the contents to the remote host directory or it will not acknowledge the new key and chmod 700 (not 600) both .ssh directories (local and remote host).

After generating the new keypair, enter the command on the local host cat .ssh/id_rsa.pub | ssh <user>@<remotehost> 'cat >> .ssh/authorized_keys' This will take the output of your authorized keys on your local machine and place it on the remote machine as well. Moreover, you'll need to ensure you have RWX access, and not just RW.

share|improve this answer
ssh-copy-id does exactly the catting you describe (except for all public keys not just RSA) with some added errorchecking AND setting the permisssions for you. – dave_thompson_085 Jul 7 at 8:23

try chmod 0600 ~/.ssh

And make sure your directory permissions are valid.

I have encountered directories of .ssh with ??????? options when doing an ls -l due to restoring from backups.

share|improve this answer
This is incorrect. chmod 0600 ~/.ssh will make it so you can't even cd ~/.ssh anymore. You probably meant chmod 0700 ~/.ssh. – dg99 Nov 8 '13 at 19:15
.ssh is chmod 700 and .ssh/authorized_keys chmod 640. – GiannakopoulosJ Jun 13 at 21:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.