How to fix Permission denied (publickey,gssapi-keyex,gssapi-with-mic). in SSH

Check that your private key exists and has correct permissions on the client machine:

ls -la ~/.ssh/id_rsa
ls -la ~/.ssh/id_rsa.pub

If the key doesn't exist, generate one:

ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N ""

Then fix permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub

Add your public key to the server's authorized_keys file. Use ssh-copy-id (easiest):

ssh-copy-id -i ~/.ssh/id_rsa.pub user@remote-host

Or manually:

cat ~/.ssh/id_rsa.pub | ssh user@remote-host "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Then verify the authorized_keys file has correct permissions (must be exactly 600):

ssh user@remote-host "chmod 600 ~/.ssh/authorized_keys && chmod 700 ~/.ssh"

Log in to the server (you may need to use password authentication temporarily) and check /etc/ssh/sshd_config:

sudo grep -E "^(PubkeyAuthentication|AuthorizedKeysFile|GSSAPIAuthentication)" /etc/ssh/sshd_config

Ensure these settings are present and uncommented:

PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2

If GSSAPI is not needed, you can disable it to simplify troubleshooting:

GSSAPIAuthentication no

After making changes, restart SSH:

sudo systemctl restart sshd
# or on older systems:
sudo service ssh restart

Run SSH with maximum verbosity to see exactly where authentication is failing:

ssh -vvv user@remote-host

The output will show:
- Whether the client is sending the correct key
- Whether the server is receiving it
- Which authentication method is being attempted
- Specific error messages from GSSAPI or key exchange

Common debug indicators:
- "Offering public key" → client is offering the key
- "Server host key verification failed" → known_hosts issue
- "gssapi-with-mic: Unspecified GSS failure" → Kerberos/GSSAPI problem

On the server, ensure the user's home directory has correct permissions:

chmod 755 ~

This allows the SSH daemon to access the home directory while preventing other users from reading its contents.

If you're on RHEL/CentOS with SELinux, also restore the context:

sudo restorecon -R -v ~/.ssh

If you're still having issues and GSSAPI is involved, try disabling GSSAPI on the client to isolate the problem:

ssh -o GSSAPIAuthentication=no user@remote-host

If this works, the issue is with your GSSAPI/Kerberos setup. If it still fails, the issue is with public key authentication.

To make this permanent in your SSH config:

# ~/.ssh/config
Host remote-host
    User user
    HostName remote-host
    IdentityFile ~/.ssh/id_rsa
    GSSAPIAuthentication no