31

So I need to log in to a machine using a password instead of a key, which I practically never do. Seems it should be easy but nope, ssh refuses to use anything but a key.

ssh -o PreferredAuthentications=keyboard-interactive -o PubkeyAuthentication=no root@ip-address
root@ip-address: Permission denied (publickey).
2
  • You can also temporarily rename your .ssh directory to prevent ssh from accessing your public key: mv .ssh .ssh.save; ssh -vvv ...; rm -f -r .ssh; mv .ssh.save .ssh If you use the -vvv or -v -v -v "max verbose" option, you should get some good information. Nov 17, 2018 at 12:22
  • related, and also the right answer for the first half of the question unix.stackexchange.com/questions/15138/… Jan 26 at 12:02

6 Answers 6

21
root@ip-address: Permission denied (publickey)

This message means your server only allow publickey, thus please enable password auth in /etc/sshd_config with:

Password Authentication yes

It is possible your system allow password but not keyboard-interaction, like

Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password)

In this case, you need to use following instead:

ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no [email protected]
1
  • In my case, the file was located in this path /etc/ssh/sshd_config. Ubuntu 20
    – Ikdemm
    Dec 5, 2023 at 11:44
7

You try using correct parameters for disabling authentication over keys. Maybe server reject password authentication? Check server ssh configuration.

2
  • 5
    Specifically, check for PasswordAuthentication directive in /etc/ssh/sshd_config on the server.
    – confetti
    Nov 17, 2018 at 12:04
  • This was indeed the issue. Nov 19, 2018 at 10:03
6

Turns out the solution was to set PasswordAuthentication yes in /etc/ssh/sshd_config.

Thanks to the several people who pointed me in the right direction.

4

To use password authentication instead of a key, SSH must allow passwords. Inside of /etc/ssh/sshd_config Change the PasswordAuthentication option from no to yes (Note this is bad practice):

PasswordAuthentication yes

Because your example shows the user as root, you must also allow root to login via a password. (Note this is bad practice)

PermitRootLogin yes

Restart ssh for the setting to take effect:

systemctl restart sshd

Now, you can specify you desire password authentication when connecting via CLI rather than permanently with config files:

ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no -o PasswordAuthentication=yes root@ip-address
3
Permission denied (publickey)

The "(publickey)" string in that error message is the list of authentication methods accepted by the remote server. In this case the remote server only accepts public key authentication. You can change your client parameters all you like, but it won't alter the fact that the server will only accept public key authentication.

To log in with a password, you'd have to start by reconfiguring the remote server to accept password authentication.

1

This error might also happen if your ssh server has a login attempt limit and you have more than that number of saved ssh keys. The ssh command will attempt all ssh keys before asking for a password as one can se using the -v flag.

Anyway after playing enough with SSH I figured that you can also set up a such configuration to be specific to an ssh host. Using the ~/.ssh/config file you can use the exact same options and many more! https://www.ssh.com/academy/ssh/config

Here is an example:

Host nickname x.x.x.x example.com 
     Hostname ip_addr_or_fqdn
     User example_username
     PreferredAuthentications password
     PubkeyAuthentication no

Then you might just login using ssh nickname or ssh x.x.x.x or ssh example.com and it should attempt to login as example_user without trying any of the ssh-keys you might have already installed and ask you for a password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .