How to Fix "SSH error: permission denied (publickey, gssapi-keyex, gssapi-with-mic)"

Connecting to remote servers or Git repositories via SSH frequently fails with the authentication error Permission denied (publickey, gssapi-keyex, gssapi-with-mic). This error signifies that the remote OpenSSH daemon evaluated all client-offered authentication mechanisms and rejected them because no matching public key was found in ~/.ssh/authorized_keys, or because permission checks on SSH files failed strictly. Correcting file permissions, specifying the correct identity file, and inspecting SSH debug logs solves this issue rapidly.

The Problem

When sending requests or configuring components in your development environment, the application or HTTP client fails with the following exact error trace:

# Example 1: Standard SSH connection attempt failure
user@local:~$ ssh -i ~/.ssh/id_rsa user@remote-server.com
user@remote-server.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

# Example 2: Verbose SSH debug trace (ssh -v) showing rejected key
debug1: Offering public key: /home/user/.ssh/id_rsa RSA SHA256:abc123xyz...
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: No more authentication methods to try.
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

# Example 3: Git over SSH command error
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

This error halts script execution, prevents API communication, or results in immediate client-side connection drops.

Why It Happens

This failure occurs due to misconfigurations at the networking, cryptographic, or application protocol layer. The primary causes include:

• Overly Permissive Server File Permissions: OpenSSH strictly enforces security checks. If ~/.ssh or ~/.ssh/authorized_keys on the remote host are writable by group or world (e.g., 777 permissions), OpenSSH silently ignores the key file.
• Unloaded SSH Key in Agent: The default private key is stored under a custom name (not id_rsa or id_ed25519) and has not been added to the local running ssh-agent instance.
• Public Key Missing in authorized_keys: The public key corresponding to your local private key was never copied into the target user's ~/.ssh/authorized_keys file on the remote server.
• Deprecated RSA Key Signature Algorithms: Modern OpenSSH versions (8.8+) disable SHA-1 based RSA signatures by default, causing older ssh-rsa keys to be rejected unless modern key types (Ed25519) or explicit SSH flags are used.

The Fix

Follow these step-by-step solutions to resolve the error in your environment.

Step 1: Enforce Strict Linux File Permissions

Connect to the remote host (via console or alternative access) and reset permissions on SSH directories to comply with OpenSSH requirements:

# Fix directory and file permissions on remote server
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod 755 /home/username

# Ensure correct owner assignment
chown -R username:username ~/.ssh

On your local client machine, ensure your private key file is restricted:

chmod 600 ~/.ssh/id_ed25519

Step 2: Add SSH Key to ssh-agent and Test Verbose Logs

Ensure your private key is loaded in memory by starting the agent and registering your key file explicitly:

# Start ssh-agent in background
eval "$(ssh-agent -s)"

# Add private key to agent
ssh-add ~/.ssh/id_ed25519

# List active keys in agent
ssh-add -l

Step 3: Generate Modern Ed25519 Key and Copy to Server

If using older RSA keys rejected by newer OpenSSH daemons, generate a modern Ed25519 key pair and deploy it using ssh-copy-id:

# Generate new Ed25519 key
ssh-keygen -t ed25519 -C "admin@yourdomain.com"

# Copy key to remote server
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@remote-server.com

Step 4: Configure ~/.ssh/config for Host Identification

Create or edit ~/.ssh/config on your local client machine to route connections to the precise identity file:

Host remote-server
    HostName remote-server.com
    User deploy
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes
    PubkeyAuthentication yes

Still Not Working?

OpenSSH Server sshd_config Restrictions

If SSH permission denied (publickey, gssapi-keyex, gssapi-with-mic) persists, inspect the remote server's /etc/ssh/sshd_config. Verify that public key authentication is enabled and that user access is not restricted by AllowUsers or Match Group directives. Run SSH in verbose debug mode from your local terminal to isolate exact failure points:

ssh -vvv -i ~/.ssh/id_ed25519 user@remote-server.com

Check the server authentication log (/var/log/auth.log or journalctl -u sshd -e) on the remote machine for specific error reasons such as Authentication refused: bad ownership or modes for directory.