SSH Permission Denied (publickey): The Real Fix

The error "Permission denied (publickey)" occurs when every key offered by the client during an SSH connection is refused by the server. This is a negotiation result, not a password typo. To diagnose the issue, use "ssh -vvv" to see the keys offered and the server log "journalctl -u ssh" to see which keys are refused and why. The four possible causes are:

1. Wrong user: The key is installed for a different user than the one you're trying to connect to.

Solution: Use the correct user when running the SSH command.

2. Key missing from authorized_keys: The key is not present in the target user's ~/.ssh/authorized_keys file.

Solution: Add the key to the authorized_keys file and set proper permissions: chmod 700 ~/.ssh and chmod 600 ~/.ssh/id_ed25519 ~/.ssh/authorized_keys

3. Permissions too open: The private key file has incorrect permissions, making it inaccessible to the SSH client.

Solution: Set strict permissions: chmod 700 ~/.ssh and chmod 600 ~/.ssh/*

4. ssh-rsa key refused by OpenSSH 8.8+: The server's OpenSSH version has disabled ssh-rsa signatures by default, while the key used may still be signed with the legacy format.

Solution: Regenerate the key as ed25519, or upgrade the key to a supported format.

Using "ssh-copy-id" can help prevent recurrence of the issue, as it adds the public key to the authorized_keys file with proper permissions and handles potential issues like trailing newlines.