I have both: password and pubkey authentication available on my server. I can log from client with key specified explicitely:

ssh user@host -i id_rsa

When I don't specify keyfile, it asks for password. But I'd like to login with keyfile by default.

I found a hint, that I can put something into ~/.ssh/config. So I specified something like this:

Host xxx
    IdentityFile ~/.ssh/id_rsa
    IdentitiesOnly yes
    User uuu

The config is interpreted - user 'uuu' is used but keyfile is still ignored. How to make ssh to prefer it by default?

  • 1
    Are you in your ~/.ssh directory when you give the command? Put it another way is there a id_rsa in the current directory? – icarus Nov 21 '16 at 20:55
  • Hopefully "uuu" is the same as "user" from the working example? – Jeff Schaller Nov 21 '16 at 20:57
  • Jeff: sure, sorry for confusion. And of course user is substituted when NOT specified in the command line – ardabro Nov 21 '16 at 21:00
  • Post a complete verbose log from your ssh -vvv host (or xxx). – Jakuje Nov 21 '16 at 21:41
  • Output of ls -la ~/.ssh please, added to your question – roaima Nov 21 '16 at 22:47

If you have a directory ~/.ssh and a private key id_rsa in your ~/.ssh owned by you with file mode 0600 (-rw-------) then ssh will use it automatically, and ask for a password only if public key authentication fails. Check that all those conditions are fulfilled. The -i option is normally used when you need to authenticate with a different key.


Your config file should be

Host xxx
  User user
  IdentityFile ~/.ssh/id_rsa

You have to check the rigth on the files :

~/.ssh/id_rsa : rwx------

On the remote host :

  • /home/user : no write rights for group and other
  • /home/user/.ssh: rwx------

You can check the log file on the remote host and you could see some error messages :

tail -f /var/log/auth.log

Assuming that you have a Server with SSH, and a client from where you want to connect to Server, you need to create the private and public keys in the client machine, and copy the public key in the server.

Before this, you need to check where your SSH Server is looking for client authorized keys. You need to check your SSH Server config file /etc/ssh/sshd_config, and locate the next line:

AuthorizedKeysFile      .ssh/authorized_keys

This tells that the server will search in the file called authorized_keys of each user home directory, into .ssh folder, for the public keys authorized for the login of this user.

Now, in your client, as you said that you have already using the SSH key generated in the client, you need to copy the content of your public key into the authorized_keys file of the user which you want to login in the server.

For simplifying this, the steps are:

  • Search for the AuthorizedKeysFile directive in /etc/ssh/sshd_config in the server.
  • Create the private and public keys in the client (you have already did it).
  • Copy the content of your client public key to the authorized_keys file of the user you want to login in the server. If you want to login with the user username, you need to copy the public key to /home/username/.ssh/authorized_keys file (create it if doesn't exist).

Hope this helps.


Thanks all. It seems that this was an issue with ssh-agent. After restart everything is OK. I think it didn't refresh some configuration on-the fly when accepted login methods changed on server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.