Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a CentOS 6.3 server and with a user named ako.
I am running Kubuntu 12.10 as my client and I have copied my public key to the server using the ssh-copy-id command.
I have updated the /etc/ssh/sshd_config file with these values:

RSAAuthentication yes
PubkeyAuthentication yes
StrictModes yes
PasswordAuthentication no

But, when I try to login to the server, I get this error:

Permission denied (publickey).

I have setup SSH many many times before without problems, but I have no idea why this one does not work!!

This is the output of ssh ran in verbose mode:

ssh ako@123.456.789.000 -v
OpenSSH_6.0p1 Debian-3ubuntu1, OpenSSL 1.0.1c 10 May 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 123.456.789.000 [123.456.789.000] port 22.
debug1: Connection established.
debug1: identity file /home/ako/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/ako/.ssh/id_rsa-cert type -1
debug1: identity file /home/ako/.ssh/id_dsa type -1
debug1: identity file /home/ako/.ssh/id_dsa-cert type -1
debug1: identity file /home/ako/.ssh/id_ecdsa type -1
debug1: identity file /home/ako/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-3ubuntu1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
debug1: Host '123.456.789.000' is known and matches the RSA host key.
debug1: Found key in /home/ako/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/ako/.ssh/id_rsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/ako/.ssh/id_dsa
debug1: Trying private key: /home/ako/.ssh/id_ecdsa
debug1: No more authentication methods to try.
Permission denied (publickey).
share|improve this question
up vote 2 down vote accepted

You could run your ssh in verbose mode to see the specifics... It seems you're connecting as a different user... "ako"

Check the permissions on the home directory of the "ako" user on the destination system. ssh-copy-id should have done this for you, though.

chmod go-w ~/
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
share|improve this answer
Please see the edit. – Omid Kamangar Feb 16 '13 at 15:39
After I ran the restorecon command, I ran these three commands, and finally, it's fixed!!! – Omid Kamangar Feb 16 '13 at 16:24

You've copied your id file from a system with AppArmor to a system with SELinux.
On the Centos 6.3 machine run either:

  • restorecon ~/.ssh/authorized_keys
  • chcon unconfined_u:object_r:ssh_home_t:s0 ~/.ssh/authorized_keys

In the end the context should look like.

ls -Z .ssh/authorized_keys
-rw-------. user user unconfined_u:object_r:ssh_home_t:s0 .ssh/authorized_keys

share|improve this answer
I would actually do restorecon -Rv ~/.ssh, to get all contexts right on the entire dir. – lsd Feb 16 '13 at 15:57
I ran the restorecon command on the CentOS, and the output of ls is the same, except for the permission which is -rw-r--r--. But still, I get the error. – Omid Kamangar Feb 16 '13 at 16:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.