I am trying to SSH to a new EC2 server from AWS by using Xshell, but got below error. Does it mean Public key in Client is not added into authorized_keys in Server side? How to verify which RCA for the error then give fixing?

[bastion-ro@ip-10-1-X-XX ~]$ ssh webuser@10.1.X.XX
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
[bastion-ro@ip-10-1-X-XX .ssh]$ cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.5 (Maipo)

Thanks for any advice.

  • You can see which keys are inspected by making the command verbose: ssh -vvv. Mar 10, 2021 at 7:18

1 Answer 1


You can't be sure about problem without checking server-side log. While running ssh -v you can only guess. If it would explicitly show what's wrong, it would make potentional attack easier, it would reveal important info for the attacker. An example below:

debug1: Host '' is known and matches the ECDSA host key.
debug1: Found key in /home/jiri/.ssh/known_hosts:30
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: /tmp/test RSA SHA256:vOJarZ7K6aLtlnPvQnzx1MxA/36iV4xkubPY4PhlEKA explicit

Client is trying to use ssh key in /tmp/test.

debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: /tmp/test RSA SHA256:vOJarZ7K6aLtlnPvQnzx1MxA/36iV4xkubPY4PhlEKA explicit
debug1: Authentications that can continue: publickey,keyboard-interactive

Server was not happy, it does not show debug1: Authentication succeeded (publickey).

debug1: Next authentication method: keyboard-interactive
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: No more authentication methods to try.
nonexistent@ Permission denied (publickey,keyboard-interactive).

You cannot know if the user is wrong or the key is missing or a restriction on the key is applied which causes authentication failure. In above example, the user was not existent at all.

  • Hi Jiri, Got, thanks for show advice. Agree you, I will check with ssh -v in next time and find the RCA. Mar 10, 2021 at 9:43
  • As I said, from ssh -v (on client) you can't make appropriate root cause analysis.
    – Jiri B
    Mar 10, 2021 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.