DigitalOcean Droplet SSH Permission Denied (publickey)

How to fix it

Try these in order — the most common fix is first.

1. 1. Find out what the server accepts

   Copy steps
   1. Run ssh -v root@YOUR_IP (use -vvv for more detail)
   2. Look for the line "Authentications that can continue". If it lists only publickey, password login is disabled
   3. Check which key files the client offers and that the private key is readable (chmod 600 ~/.ssh/id_ed25519)
   Did this fix it? Yes No

2. 2. Confirm the key matches

   Copy steps
   1. Print the public key from your private key: ssh-keygen -y -f ~/.ssh/id_ed25519
   2. Compare it with the key listed for the Droplet in Settings > Security, and with the line in ~/.ssh/authorized_keys on the Droplet
   Did this fix it? Yes No

3. 3. Fix permissions and add your key via the Recovery Console

   Copy steps
   1. In the Control Panel open the Droplet, go to Settings, scroll to Recovery console, click Launch Console
   2. If you have no password, use Reset root password on the same tab first; the temporary password is emailed to you
   3. Log in, then run chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys
   4. Paste your public key on its own line in ~/.ssh/authorized_keys and try ssh again
   Did this fix it? Yes No

4. 4. Check sshd_config

   Copy steps
   1. Open /etc/ssh/sshd_config (on newer images also check files under /etc/ssh/sshd_config.d/)
   2. Make sure the login method you use is enabled (PubkeyAuthentication yes, or PasswordAuthentication yes), and PermitRootLogin is not "no" if you log in as root
   3. Restart the service: systemctl restart ssh (Ubuntu/Debian) or systemctl restart sshd (CentOS/Fedora)
   Did this fix it? Yes No

Symptoms

ssh root@your-ip returns "Permission denied (publickey)" or "Permission denied, please try again".

Why it happens

• Your public key is not in ~/.ssh/authorized_keys on the Droplet (key was not added at creation)
• ~/.ssh is not 700 or authorized_keys is not 600, or they are owned by another user
• Client is offering a different key than the one on the Droplet
• PasswordAuthentication is off in sshd_config and you are trying a password
• PermitRootLogin blocks root, or the key type is unsupported (old DSA keys on OpenSSH 7+)

This guide also covers

• digitalocean ssh permission denied publickey
• droplet permission denied please try again
• digitalocean ssh key not working
• digitalocean lost ssh key

Other DigitalOcean errors

• DigitalOcean Droplet SSH Connection Refused or Timed Out
• DigitalOcean Droplet 502 Bad Gateway (Nginx)
• DigitalOcean Droplet Out of Memory (OOM Killer)
• DigitalOcean App Platform Build Failed
• DigitalOcean App Platform Deploy Failed or 502 After Deploy
• DigitalOcean Account Locked or Verification Required
• DigitalOcean Unexpected Bill: Charged for Deleted or Powered-Off Droplets
• DigitalOcean Droplet Locked Out: Reset Root Password and Recovery Console