UPDATE: I've solved this strange problem by simply restart sshd. However, I'm still wondering why, because I didn't change any configs since the server started.

I have 2 servers, one installed CentOS 5 and the other is CentOS 6. ssh publickey works fine on the CentOS 5 one, but it doesn't work on the CentOS 6. I confirmed the permissions of .ssh directory, it's fine.

[root@localhost ~]# ls -Z .ssh/
drwxr-xr-x. root root unconfined_u:object_r:ssh_home_t:s0 .
dr-xr-x---. root root system_u:object_r:admin_home_t:s0 ..
-rw-r--r--. root root unconfined_u:object_r:ssh_home_t:s0 authorized_keys
-rw-------. root root unconfined_u:object_r:ssh_home_t:s0 id_rsa
-rw-r--r--. root root unconfined_u:object_r:ssh_home_t:s0 id_rsa.pub
-rw-r--r--. root root unconfined_u:object_r:ssh_home_t:s0 known_hosts

UPDATE: I've tried several permissions, including 600, 644 for authorized_keys, and 700, 755 for .ssh/, all of them don't work.

ssh -vvv gives these message

debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/zuohaocheng/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Trying private key: /Users/zuohaocheng/.ssh/id_dsa
debug3: no such identity: /Users/zuohaocheng/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password

Everything in sshd_config is as default. Also, I copied publickey through ssh-copy-id.

  • That authorized_keys file is dated 2012-03-31. When did you copy your public key up to the server? Also, what command are you using on the client to ssh to the server?
    – Ladadadada
    Jan 14, 2013 at 13:41
  • is the format of the authorized_keys right ?
    – golja
    Jan 14, 2013 at 13:46
  • @Ladadadada ssh -vvv username@host. The public key is generated on 2012, so the date should be fine.
    – Haocheng
    Jan 14, 2013 at 13:56
  • 3
    Please show either the error log from the SSH server, or the output of sshd -d. Keep in mind that the daemon will only process a single connection when started in debug mode.
    – Andrew B
    Jan 14, 2013 at 14:56
  • @AndrewB I can only access the server through ssh, so I'm afraid that if I use sshd -d, some small mistakes may cause a much more serious problem.
    – Haocheng
    Jan 15, 2013 at 1:07

6 Answers 6


You have wrong permission for authorized_keys. You should unset read permission for group and other.

  • Thank you, but after I corrected it to 600, it still doesn't work.
    – Haocheng
    Jan 14, 2013 at 13:18
  • You should set 600 to authorized_keys on the ssh-server. You better use ssh-copy-id ssh-server for it
    – dchirikov
    Jan 14, 2013 at 13:21
  • I used ssh-copy-id exactly, so I feel strange.
    – Haocheng
    Jan 14, 2013 at 13:24
  • So you can change LogLevel to DEBUG in /etc/ssh/sshd_config on ssh-server and examine /var/log/messages
    – dchirikov
    Jan 14, 2013 at 13:28
  • 1
    ssh will work with 644 on authorized_keys but no more open than that.
    – user9517
    Jan 14, 2013 at 13:32

The Directory/ file permissions should look as the following:

chmod 700 ~/.ssh 
chmod 644 ~/.ssh/authorized_keys
chmod 644 ~/.ssh/known_hosts
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub 

ls -l ~/.ssh should show you the chmod permissions. Check if PermitRootLogin Yes is enabled since you are copying the pub key generated in root's .ssh directory. This could generate the problem.

  • Thank you, but I've tried several privileges including this, they all don't work.
    – Haocheng
    Jan 14, 2013 at 13:20
  • Your authorized_keys should be 644 (rw-r-r) not 600 (rw- - ) Jan 14, 2013 at 13:23
  • I've tried, but both of 644 and 600 don't work.
    – Haocheng
    Jan 14, 2013 at 13:25
  • Can you update the post and show what ls -l ~/.ssh shows? Jan 14, 2013 at 13:26
  • 1
    755. I've tried 700 as well, both don't work.
    – Haocheng
    Jan 14, 2013 at 13:43

What are the permissions on ~/ (your home directory)? You cannot allow permissions at any level that would allow others to overwrite your ~/.ssh directory. If your home directory is anything more permissive than 755, you will be prompted for a password.


If you are running selinux, that could be the issue. The type of the .ssh dir and files underneath should be ssh_home_t. You can verify with ls -Z, and restore with restorecon -Rv .ssh.

/var/log/secure might have more detailed error messages also.

  • Thank you for your advices, I've fixed them, but it still doesn't work. Also, that log doesn't give any information.
    – Haocheng
    Jan 14, 2013 at 14:40

Permission on authorized_keys must be 600 to make public key authentication work.


I'm running into the same issue and it turns out it's related to the fact that I moved my home directory to another disk (for space reasons) and the default security settings don't like this new place, so thus cannot or will not find my .ssh directory. Trying to figure out out to update the ssh_home_t settings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.