SSH Key Permissions: The 5-Minute Fix That Actually Works

SSH Key Permissions: The 5-Minute Fix That Actually Works

Here’s a fun one that bites you at 2am.

User calls: “I added a new key to authorized_keys but it still won’t work.” You check the file — it’s there, permissions look fine. You cat ~/.ssh/authorized_keys and the key looks correct. You ssh -v and… nothing useful.

Nine times out of ten, the problem isn’t the key. It’s the permissions on something upstream.

The Exact Permission Matrix

OpenSSH is picky about permissions. Not politely suggestive — actively hostile. It will silently ignore your authorized_keys file if any of these are wrong:

Home directory:      755 or stricter (no 777, no 775 group-writable)
.ssh directory:     700 (only the owner can access it)
authorized_keys:    600 (only the owner can write it)

Enter fullscreen mode Exit fullscreen mode

That’s it. Those are the three you need to check.

How to Verify Quickly

The sshd -T command does a dry-run of your sshd config and prints out the effective settings. But more useful: you can test a specific user’s key authentication with:

sshd -T -C user=username -C host=hostname -C laddr=0.0.0.0 -C lport=22

Enter fullscreen mode Exit fullscreen mode

But for a quick local check on the permission issues themselves, just use namei:

namei -l ~/.ssh/authorized_keys

Enter fullscreen mode Exit fullscreen mode

This shows you the permission bits on every component of the path. If you see anything like drwxrwxr-x instead of drwxr-x---, that’s your culprit.

The chmod Commands (When You’re Fixing It)

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod 500 ~  # if needed, though 755 usually works

Enter fullscreen mode Exit fullscreen mode

Don’t do chmod 777 on anything. I know it’s tempting when you’re tired. Don’t.

One Gotcha Worth Knowing

If the user’s home directory itself is group-writable or world-writable, OpenSSH will still refuse to trust the .ssh directory. So even if your .ssh and authorized_keys are perfect, a sloppy home directory breaks everything.

# Check this too
stat -c "%a %n" ~

Enter fullscreen mode Exit fullscreen mode

If it returns anything other than something like 755 or 700, fix it first.

The Payoff

Once permissions are right, the key works. No daemon restart needed. No config change. Just permissions.

It’s one of those things that’s obvious in retrospect but easy to overlook when you’re staring at a correct-looking authorized_keys file wondering why SSH keeps asking for a password.

Tags: sysadmin, ssh, security, devops