I can't do ssh public key login to my server and I think this issue is related to the fact my home is encrypted. I chose the option "encrypt my home folder" under the Ubuntu install setup. The permissions on /home/MY-USER are 700.

I've tried another workstation and everything works fine. I would be glad if someone help me to get out this without removing the encryption.

  • Add -v to your ssh commandline and see if you find any interesting entries. If not, increase the verbose level to -vv, and then -vvv.
    – pkhamre
    Sep 4, 2012 at 13:00
  • 1
    When you say you've tried another workstation, did it have an encrypted home directory as well?
    – Safado
    Sep 4, 2012 at 14:10

3 Answers 3


If your home directory is encrypted, the ssh daemon can't get in it to check if your private key matches your public one. Your .ssh folder is encrypted after all.

A workaround for this might be to have your .ssh folder with your authorized_keys in plaintext in your unencrypted home directory. But if your encryption techinque uses your password as a key to decrypt everything you will still have to type it in to get everything decrypted.

So a true passwordless login will not work here. (unless you want to store your password somewhere in cleartext to be automatically fed to the decryption process, but this is even more unsecure then not encrypting at all.)

What technique are you using to encrypt your home directory?

Update: ubuntu uses ecryptfs to mount an encrypted partition on login time (so when you supply your password) To make ssh find your .ssh folder again you can do this:

# copy your .ssh folder 
mkdir /tmp/mine
chmod 700 /tmp/mine
mkdir /tmp/mine/.ssh
chmod 700 /tmp/mine/.ssh
cp ~/.ssh/authorized_keys /tmp/mine/.ssh/
cd /tmp/mine
# unmount your encrypted home drive
# copy your ssh folder to the place ssh will actually look for
cp -r .ssh ~
# be sure to remove it again from /tmp
rm /tmp/mine/ -rf

You should now be able to login again, but you will not have your home folder unencrypted automatically. To mount it unencrypted you will have to enter this on every login:


Which will ask you for your login password again.

More information on this can be found here: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/362427

  • hi Jens, yes.. I know the implications. I choose the option "encrypt my home folder" under Ubuntu install setup, so I don't know what encrypt technique was used.
    – lucasvscn
    Sep 4, 2012 at 19:33
  • 1
    To play a little safer, just copy the authorized_keys file to the unencrypted dir - to login remotely you don't need anything else, and exposing unencrypted private keys can be a security risk.
    – gerlos
    Jan 3, 2020 at 17:21
  • Why not set AuthorizedKeysFile in sshd_config to check several locations? Jul 16, 2020 at 19:29

In the ssh_config file, you can can change the location of where it looks for your private key. You could probably do something like make a new folder at /etc/ssh/keys/ and put your id_rsa private key file in there and then change the IdentityFile option in ssh_config to look in the new location. In doing so you'll want to take certain measures to secure your private key.

This is assuming you're the only user of the computer. If not, you can make folders like /etc/ssh/keys/john/ and /etc/ssh/keys/dogbert/ and then in the IdentityFile option put /etc/ssh/keys/%u/id_rsa

  • After seeing cjc's answer, it brings up an important detail that you left out. Is the encrypted home folder on your workstation or on the server? If it's on the server, then you need to follow cjc's instructions.
    – Safado
    Sep 4, 2012 at 15:03
  • thank you! this worked for me. I put my id_rsa under /etc/ssh/keys with 666 permissions and so I was able to login :)
    – lucasvscn
    Sep 4, 2012 at 19:34
  • @lucasvscn Please change those permissions immediately. You do not want that to be go+w.
    – derobert
    Sep 4, 2012 at 20:02
  • @derobert you're right! but, when I first copy id_rsa to /etc the owner was changed to root and the only way to work was giving to it 666. I just fix it putting my user as owner and the permissions to 600.
    – lucasvscn
    Sep 4, 2012 at 20:24
  • permissions of 400 should be sufficient Oct 26, 2016 at 14:55

I had the same problem on an arch linux server, with a home directory encrypted with ecryptfs. To be able to login with ssh keys I first had to have logged in from the server console in order to have a decrypted .ssh/authorized_keys file. I have solved it as follows: I first copied the content of the .ssh directory to a safe location. Then, as root user:

In the home/.ecryptfs/<my username> directory I created a .ssh directory with permission 700 and under my own username and group (so, not root). Then I copied the content of my original .ssh directory (in my case, only an authorized_keys file) from the safe to this location, with permission 600 and under my own username and group. In the /etc/ssh/sshd_config file, using Safado's solution, I used the following option: AuthorizedKeysFile /home/.ecryptfs/%u/.ssh/authorized_keys

Finally, in my home directory and under my own user name, I removed the .ssh directory and its content and replaced it with a soft link:

rm -rf .ssh (or use mv .ssh .ssh.bkp)

ln -s /home/.ecryptfs/<my username>/.ssh .

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .