DEV Community

Python-T Point
Python-T Point

Posted on • Originally published at pythontpoint.in

☁️ Fix ssh permission denied ubuntu ec2 issues with ease

#devops #googlecloud #cloud #linux

❓ ssh permission denied ubuntu ec2 fix? The error indicates that the SSH daemon rejected the key, typically due to incorrect file permissions or mismatched user configuration. The root cause may reside in filesystem permissions, key placement, daemon configuration, or network rules.

ssh permission denied ubuntu ec2 fix

Fixing ssh permission denied ubuntu ec2 fix requires aligning filesystem permissions, placing the correct public key in authorized_keys, and configuring EC2 security settings to allow SSH traffic.

📑 Table of Contents

  • ❓ ssh permission denied ubuntu ec2 fix? The error indicates that the SSH daemon rejected the key, typically due to incorrect file permissions or mismatched user configuration. The root cause may reside in filesystem permissions, key placement, daemon configuration, or network rules.
  • 🔐 Permissions — Why They Matter
  • 🗝️ SSH Keys — How They Authenticate
  • 🔑 Generate a Key Pair
  • 📤 Deploy the Public Key
  • 🖥️ EC2 Instance — Configuring the Instance
  • 📡 Network — Ensuring Connectivity
  • 🔒 Security Group Rules
  • 🚧 Network ACL Checks
  • 🧹 Common Pitfalls — Avoiding Mistakes
  • 🟩 Final Thoughts
  • ❓ Frequently Asked Questions
  • Why does changing file ownership sometimes not fix the error?
  • Can I use a different SSH port and still get the same permission denied error?
  • Is it safe to set StrictModes no to bypass permission checks?
  • 📚 References & Further Reading

🔐 Permissions — Why They Matter

File permissions on the .ssh directory and its contents determine whether the SSH daemon will accept a key. The daemon enforces strict ownership and mode checks (via StrictModes) before reading the key file.

$ ls -ld /home/ubuntu/.ssh
drwx------ 2 ubuntu ubuntu 4096 Apr 12 08:15 /home/ubuntu/.ssh
Enter fullscreen mode Exit fullscreen mode

If the directory mode differs from drwx------ or is owned by another user, the key is ignored.

# Set the correct permissions
$ chmod 700 /home/ubuntu/.ssh
$ chmod 600 /home/ubuntu/.ssh/authorized_keys
$ chown -R ubuntu:ubuntu /home/ubuntu/.ssh
Enter fullscreen mode Exit fullscreen mode

What this does:

  • chmod 700: Allows only the owner to read, write, and traverse the directory.
  • chmod 600: Restricts authorized_keys to owner‑only read/write.
  • chown -R: Guarantees the ubuntu user owns the directory and its files.

Key point: The SSH daemon rejects keys when the .ssh directory or authorized_keys file is not owned by the target user or has permissive mode bits; correcting these permissions is the first step in any ssh permission denied ubuntu ec2 fix.

🗝️ SSH Keys — How They Authenticate

SSH keys are cryptographic tokens used by the client and server to prove identity. The public key must be present in authorized_keys; the private key presented by the client must match it.

# Generate a new key pair (if missing)
$ ssh-keygen -t rsa -b 4096 -f ~/.ssh/ec2_key -N ""
Generating public/private rsa key pair.
Your identification has been saved in /home/user/.ssh/ec2_key
Your public key has been saved in /home/user/.ssh/ec2_key.pub
Enter fullscreen mode Exit fullscreen mode

Deploy the public key to the instance:

# Using ssh-copy-id (preferred)
$ ssh-copy-id -i ~/.ssh/ec2_key.pub ubuntu@ec2-3-12-45-67.compute-1.amazonaws.com
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/user/.ssh/ec2_key.pub"
Number of key(s) added: 1 Now try logging into the machine with:
ssh -i ~/.ssh/ec2_key ubuntu@ec2-3-12-45-67.compute-1.amazonaws.com
Enter fullscreen mode Exit fullscreen mode

The daemon reads authorized_keys and validates the signature presented by the client.

🔑 Generate a Key Pair

The ssh-keygen command creates a 4096‑bit RSA key, which exceeds the security requirements of typical EC2 workloads. The private key remains on the client; only the public key is transferred to the server.

📤 Deploy the Public Key

Using ssh-copy-id writes the key to ~/.ssh/authorized_keys and sets the correct permissions automatically.

Key point: An ssh permission denied ubuntu ec2 fix caused by a missing or mismatched key is resolved by ensuring the public key resides in authorized_keys and the client uses the corresponding private key.

🖥️ EC2 Instance — Configuring the Instance

The EC2 instance runs the OpenSSH daemon, which reads its configuration from /etc/ssh/sshd_config. Examining this file reveals settings that may reject a key. (Also read: Deploy a Flask App on AWS EC2 with Nginx + Gunicorn (Ubuntu 24.04, 2026))

# Verify password authentication is disabled
$ sudo grep -i '^PasswordAuthentication' /etc/ssh/sshd_config
PasswordAuthentication no
Enter fullscreen mode Exit fullscreen mode

Disabling password authentication forces key‑based login, reducing attack surface.

# Confirm the authorized keys file location
$ sudo grep -i '^AuthorizedKeysFile' /etc/ssh/sshd_config
AuthorizedKeysFile .ssh/authorized_keys
Enter fullscreen mode Exit fullscreen mode

According to the Ubuntu documentation, the default AuthorizedKeysFile location is .ssh/authorized_keys relative to the user’s home directory; custom paths cause the daemon to search in the wrong location.

After modifying the configuration, reload the daemon to apply changes:

$ sudo systemctl reload sshd
Enter fullscreen mode Exit fullscreen mode

What this does:

  • grep PasswordAuthentication: Confirms password logins are disabled, ensuring only key‑based access is allowed.
  • grep AuthorizedKeysFile: Verifies the daemon looks for keys in the expected location.
  • systemctl reload: Applies configuration changes without restarting the service.

Key point: Verifying the SSH daemon’s configuration eliminates a class of ssh permission denied ubuntu ec2 fix caused by mis‑directed key lookups.

📡 Network — Ensuring Connectivity

Even with correct keys and permissions, inbound SSH traffic must be permitted by the instance’s security group and network ACL.

$ aws ec2 describe-security-groups -group-ids sg-0a1b2c3d4e5f6g7h
{ "SecurityGroups": [ { "GroupId": "sg-0a1b2c3d4e5f6g7h", "GroupName": "default", "IpPermissions": [ { "IpProtocol": "tcp", "FromPort": 22, "ToPort": 22, "IpRanges": [ { "CidrIp": "0.0.0.0/0", "Description": "SSH from anywhere" } ] } ] } ]
}
Enter fullscreen mode Exit fullscreen mode

If the IpPermissions entry for port 22 is missing or restricts the client’s IP, the TCP handshake never completes, and the client reports “Permission denied (publickey)”.

🔒 Security Group Rules

Allow port 22 from the client’s public IP (or a broader range). A common misconfiguration is a security group limited to a private CIDR that does not include the workstation. (More onPythonTPoint tutorials)

# Add a rule for the current public IP
$ MY_IP=$(curl -s https://checkip.amazonaws.com)
$ aws ec2 authorize-security-group-ingress -group-id sg-0a1b2c3d4e5f6g7h -protocol tcp -port 22 -cidr ${MY_IP}/32
Enter fullscreen mode Exit fullscreen mode

After updating the rule, a fresh SSH attempt reaches the daemon.

🚧 Network ACL Checks

Network ACLs are stateless; both inbound and outbound rules must permit traffic on port 22. A missing outbound rule can cause the handshake to time out.

$ aws ec2 describe-network-acls -network-acl-ids acl-12345678
{ "NetworkAcls": [ { "Associations": [...], "Entries": [ { "RuleNumber": 100, "Protocol": "6", "RuleAction": "allow", "Egress": false, "CidrBlock": "0.0.0.0/0", "PortRange": {"From": 22, "To": 22} } ] } ]
}
Enter fullscreen mode Exit fullscreen mode

Ensuring both inbound and outbound entries exist eliminates connectivity‑related denial.

Key point: The network layer is a prerequisite for any ssh permission denied ubuntu ec2 fix ; without an open port 22, the SSH client cannot negotiate the key exchange.

🧹 Common Pitfalls — Avoiding Mistakes

Beyond permissions and networking, several subtle issues frequently cause the same error; recognizing them speeds up remediation.

Issue Symptom Fix
Wrong user Connecting as ec2‑user on an Ubuntu AMI Use ubuntu as the SSH user
SELinux/AppArmor enforcing “Permission denied” despite correct file modes Set enforce=0 or adjust profiles
Incorrect key format Key rejected with “invalid format” Regenerate with ssh-keygen -t rsa -b 4096

These entries illustrate that the same error message can stem from unrelated layers; a systematic checklist prevents wasted time.

Key point: A thorough ssh permission denied ubuntu ec2 fix process inspects user identity, security policies, and key integrity, not just file permissions.

🟩 Final Thoughts

Resolving ssh permission denied ubuntu ec2 fix involves aligning three independent systems: filesystem permissions trusted by the SSH daemon, the key pair that proves identity, and network rules that allow traffic to reach the daemon. When each layer is verified, the SSH handshake proceeds without rejection, providing a reliable, repeatable path for automation.

For developers managing multiple EC2 instances, codifying these steps into a script or Ansible playbook ensures consistency across environments and reduces the chance of human error.

❓ Frequently Asked Questions

Why does changing file ownership sometimes not fix the error?

Because the SSH daemon checks both ownership and mode bits. If the mode is too permissive (e.g., chmod 644 on authorized_keys), the daemon will still reject the key even if the owner is correct.

Can I use a different SSH port and still get the same permission denied error?

Yes. The error is generated after the key exchange, so changing the listening port in sshd_config does not affect the permission checks; you must still ensure the key and permissions are correct.

Is it safe to set StrictModes no to bypass permission checks?

Disabling StrictModes removes the daemon’s protection against insecure key files, exposing the instance to credential theft. The recommended approach is to fix the underlying permissions rather than relax security.

💡 Want to practise this hands-on? DigitalOcean gives new accounts $200 free credit for 60 days — enough to spin up a full Linux/Docker/Kubernetes environment at no cost.

📚 Recommended reading: Best DevOps & cloud books on Amazon — from Linux fundamentals to Kubernetes in production, curated for working engineers.

📚 References & Further Reading

  • Official Ubuntu SSH documentation — detailed description of SSH daemon behavior: ubuntu.com
  • OpenSSH manual page — authoritative source for configuration options: man7.org
  • AWS EC2 security groups guide — explains inbound rule configuration: docs.aws.amazon.com

Top comments (0)