Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My server configuration is as follows: CentOS 5.8 (final) running Nginx.

I am using the SSH2 feature of Wordpress's plugin installer.

I have installed lib2ssh and it is working (Wordpress is acknowledging it exists).

The user (called playwithbits) I supplied to wordpress is chrooted and has the home directory of /home/nginx/domains/playwithbits/

The public and private keys are located in the directory /home/nginx/domains/playwithbits/keys/ and are named and id_rsa respectively.

I have copied the contents of to the file authorized_keys located in /home/nginx/domains/playwithbits/.ssh/

I haven't set a password for the key files. However Wordpress keeps returning the error:

Public and Private keys incorrect for playwithbits

I have supplied the following information to Wordpress

Hostname: localhost
Username: playwithbits
Password: Blank
Public key: /keys/ //I have also tried the paths from server root
Private key: /keys/id_rsa

Here are the permissions I have set on the relevant folders and files:

drwx------ 2 playwithbits playwithbits 4096 Jun  8 11:25 .ssh
drwx------ 2 playwithbits playwithbits 4096 Jun  8 13:27 keys
-rw------- 1 playwithbits playwithbits  414 Jun  8 11:21 authorized_keys
-rw------- 1 playwithbits playwithbits 1.7K Jun  6 02:17 id_rsa
-rw-r--r-- 1 playwithbits playwithbits  414 Jun  6 02:17

I have also attempted to connect in debug mode in which I get the following output:

Connection from port 56674
debug1: Client protocol version 2.0; client software version libssh2_0.18 PHP
debug1: no match: libssh2_0.18 PHP
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.8
debug1: permanently_set_uid: 74/74
debug1: list_hostkey_types: ssh-rsa,ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server aes256-cbc hmac-sha1 none
debug1: kex: server->client aes256-cbc hmac-sha1 none
debug1: expecting SSH2_MSG_KEXDH_INIT
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
Received disconnect from 11: PECL/ssh2 (
debug1: do_cleanup
debug1: do_cleanup

Does anyone know why I can't use public and private key to access? If I use the account's password instead wordpress is able to log in and perform updates.

Edit: In my sshd_config file I have the following rules:

Match group web-root-locked
         ChrootDirectory /home/nginx/domains/%u
         X11Forwarding no
         AllowTcpForwarding no
         ForceCommand internal-sftp
         AuthorizedKeysFile /home/nginx/domains/%u/.ssh/authorized_keys

playwithbits is a member of web-root-locked

share|improve this question
Keys are per-session negotiation and should be referenced with the full path rather than the path relative to your ChrootDirectory. – Jeff Ferland Jun 8 '12 at 14:21
@JeffFerland Thanks, although I have tried the full path also to no avail – George Reith Jun 8 '12 at 14:35

My first instinct: id_rsa should be in ~/.ssh/

Apache may be be spawning all sorts of processes via fork, children, children of those, etc. For that, I'd find out what path Wordpress thinks its trying to open by using audit logging tools.

`auditctl -a entry,always -F arch=`arch` -F euid!=0 -S open`
`auditctl -a entry,always -F arch=`arch` -F euid!=0 -S stat`

Those should catch the attempt. You can find it by doing grep id_rsa on your audit log to see the attempted open. If that doesn't provide information, digging deeper with chdir monitoring and the like would be the path to go, but I'm pretty confident that the open syscall will catch this.

Once you know what it's trying to do, you can figure out if the path is relative to the user home directory, another user's home, the http root, the FS root, etc.


This tutorial on using ssh for Wordpress updates shows using the full path to specify the key.

Wordpress ssh connection info

share|improve this answer
Thanks for responding. I am using nginx not apache, auditctl returns auditctl: command not found in the terminal. The problem with the tutorials is they don't say whether it is chrooted or not although I have tried with both paths anyway. – George Reith Jun 8 '12 at 14:34
Well, nginx or apache, the same debugging will work. If you're on a Debian / Ubuntu system, apt-get install auditd will work. Otherwise, use your package manager of choice to install the audit facility and use it for debugging. – Jeff Ferland Jun 8 '12 at 14:37
Cheers, I installed the audit daemon however I can't run it type=DAEMON_ABORT msg=audit(1339167282.636:9975): auditd error halt, auid=4294967295 pid=4504 res=failed. Do you have any other suggestions? – George Reith Jun 8 '12 at 15:00
@GeorgeReith Well, let's try another route since that could be its own question. Is there any logging you can get from the client side? I looked closer at your debug logs and say they're from the SSH daemon. It seems to indicate that your client in Wordpress isn't trying to auth, probably because it can't find the proper ssh private key. Is there a debug mode or logging for that module you can use? Anything in the nginx logs? – Jeff Ferland Jun 8 '12 at 15:21
There's nothing in the Nginx logs about this, by module do you mean libssh2? It has no logs AFAIK and wordpress has built in functionality for it so all I get to see is wordpress's error message. – George Reith Jun 8 '12 at 15:45
up vote 3 down vote accepted

Found the answer to this with some trial and error. The keys needed to be owned by the webserver instead of the user I am attempting to log in with.

chown nginx:nginx id_rsa
chown nginx:nginx

Now it works like a dream.

share|improve this answer
This confounded me - don't use ~/.ssh/id_rsa and ~/.ssh/ because the web server doesn't have read permission in ~/.ssh. Thus, you have to store these files outside ~/.ssh. They should probably not be writable by the web server user, but they must be readable by it. – Troy Sep 2 '15 at 6:11

Try this plugin. It lets you upload SSH private keys from your computer through the browser. Public keys aren't required.

share|improve this answer

For those using apache here's how I solved the permissions issue on Ubuntu 14.04

First add the user's group so apache:

usermod -a -G myuser www-data

Then all that was necessary was grant read permissions to the private key:

chmod g+r /home/myuser/.ssh/id_rsa
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.