How to fix key_write failed in SSH

SSH requires the .ssh directory to have restrictive permissions (700). Check current permissions:

ls -ld ~/.ssh

Should show: drwx------ (700)

If permissions are wrong, fix them:

chmod 700 ~/.ssh

If the directory doesn't exist, create it:

mkdir -p ~/.ssh
chmod 700 ~/.ssh

The .ssh directory must be owned by the current user, not root or another user. Check ownership:

ls -ld ~/.ssh

Should show: user user (your username for both owner and group)

If ownership is wrong, fix it:

chown -R $USER:$USER ~/.ssh

Or explicitly:

chown -R $(whoami):$(whoami) ~/.ssh

This is especially important if you previously ran ssh commands with sudo.

Check if your filesystem has enough free space:

df -h

Look for the partition containing /home (or ~). If it shows 100% or very close (95%+), you're out of space.

Free up space by:

# Find large files in home directory
du -sh ~/* | sort -h

# Remove unnecessary files
rm -rf ~/Downloads/*  # or other large directories
rm -rf ~/.cache/pip   # Python cache

Then retry the key operation.

If a key file already exists, it may have the immutable attribute set. Check:

lsattr ~/.ssh/id_rsa 2>/dev/null || echo "File doesn't exist or no extended attributes"

If you see an 'i' flag (immutable), remove it:

sudo chattr -i ~/.ssh/id_rsa

Then retry the operation.

If your .ssh directory has issues, generate the key elsewhere temporarily and move it:

# Generate in /tmp (always writable)
ssh-keygen -t rsa -b 4096 -f /tmp/id_rsa_temp

# Move to .ssh with correct permissions
mv /tmp/id_rsa_temp ~/.ssh/id_rsa
mv /tmp/id_rsa_temp.pub ~/.ssh/id_rsa.pub
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub

This works around temporary permission issues.

On systems with SELinux (RHEL/CentOS) or AppArmor (Ubuntu), security policies might block writes. Check if either is active:

# Check SELinux (RHEL/CentOS)
getenforce

# Check AppArmor (Ubuntu)
aa-status 2>/dev/null || echo "AppArmor not installed"

If SELinux shows "Enforcing", check the context:

ls -laZ ~/.ssh

If the context is wrong, fix it:

restorecon -R ~/.ssh

For AppArmor, check the profile:

sudo aa-status | grep -i ssh

If the profile is in Enforce mode and blocking, consider switching to Complain mode temporarily for debugging.

If the filesystem is mounted read-only, no writes will succeed. Check:

mount | grep "on / "

If you see "ro" (read-only), remount as read-write:

sudo mount -o remount,rw /

Also check the home filesystem:

mount | grep "on /home"

If it's read-only, remount it:

sudo mount -o remount,rw /home

After fixing permissions and disk space, generate a fresh key:

ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N ""

Or for ED25519 (newer, recommended):

ssh-keygen -t ed25519 -f ~/.ssh/id_rsa -N ""

The -N "" skips the passphrase prompt. Verify it created successfully:

ls -la ~/.ssh/id_rsa*

Should show:
- -rw------- (600) id_rsa (private key)
- -rw-r--r-- (644) id_rsa.pub (public key)