How to fix Permission denied (keyboard-interactive). in SSH

SSHINTERMEDIATEMEDIUMUpdated Jun 19, 2026· 728 views

SSH fails with "Permission denied (keyboard-interactive)" when the server denies authentication attempts using keyboard-interactive methods, often due to authentication method configuration issues, disabled password authentication, or misconfigured authorized_keys.

Quick fix

Fixes Permission denied (keyboard-interactive).

ssh -v username@hostname
  1. Test with verbose mode to identify which authentication method is being attempted
  2. Try forcing password authentication specifically
  3. Verify SSH key authentication works (if configured)
  4. Check SSH server configuration for keyboard-interactive
ssh — error
ssh -v username@hostname
Permission denied (keyboard-interactive).

What this error means

This error occurs when SSH cannot authenticate using keyboard-interactive authentication. Keyboard-interactive is a flexible authentication method that allows the SSH server to prompt for multiple pieces of information (passwords, security tokens, multi-factor authentication codes, etc.) in sequence. When you see this error, it means the server either cannot accept keyboard-interactive authentication at all, or your credentials were rejected. The error often appears alongside other methods like "publickey" or "password", showing all available authentication methods failed.

Typical symptoms

  • SSH connection attempts are rejected immediately with "Permission denied (keyboard-interactive)"
  • The error shows other failed methods like "(publickey,password,keyboard-interactive)"
  • You cannot log in even with the correct password
  • SSH prompts for a password but rejects it
  • You can connect with SSH keys but not with password authentication
  • Automated scripts using SSH password authentication suddenly fail

Common causes

  1. Keyboard-interactive authentication is disabled on the SSH server (sshd_config has ChallengeResponseAuthentication no)
  2. Password authentication is disabled on the server and keyboard-interactive is the fallback being attempted
  3. The authorized_keys file has incorrect permissions (too open or too restrictive)
  4. User account does not exist on the remote server or is locked
  5. PAM (Pluggable Authentication Modules) configuration on the server is rejecting the connection
  6. SSH server is configured to use public key authentication only
  7. Network firewall or security group is blocking the authentication handshake
  8. Client SSH configuration (ssh_config) is forcing incompatible authentication methods

How to fix "Permission denied (keyboard-interactive)."

1Test with verbose mode to identify which authentication method is being attempted

Run SSH with verbose output to see exactly which authentication methods are being tried and which fail first:

bash
ssh -v username@hostname

Look for lines like "Offering public key authentication" or "Authentications that can continue: keyboard-interactive". The verbose output will show which method is currently failing and give you clues about the server configuration.

2Try forcing password authentication specifically

Check if password authentication works by explicitly requesting it:

bash
ssh -o PreferredAuthentications=password username@hostname

If this works, the issue is with keyboard-interactive specifically. If this also fails, the problem is likely with password-based authentication in general.

3Verify SSH key authentication works (if configured)

If you have SSH keys set up, try connecting with key-based authentication to rule out general connectivity issues:

bash
ssh -o PreferredAuthentications=publickey -i ~/.ssh/id_rsa username@hostname

If key authentication works but password authentication fails, focus on server-side keyboard-interactive and password settings.

4Check SSH server configuration for keyboard-interactive

Log in to the server via an alternative method (SSH keys, console, etc.) and examine the SSH server configuration:

bash
sudo grep -E "^(ChallengeResponse|KbdInteractive|PasswordAuthentication)" /etc/ssh/sshd_config

Look for:
- ChallengeResponseAuthentication yes (enables keyboard-interactive)
- PasswordAuthentication yes (enables password authentication)

On modern OpenSSH versions, check:

bash
sudo grep "^KbdInteractiveAuthentication" /etc/ssh/sshd_config

If these are set to no, keyboard-interactive and password authentication are disabled.

5Enable keyboard-interactive authentication on the server

If keyboard-interactive is disabled and you need it, edit the SSH server configuration:

bash
sudo nano /etc/ssh/sshd_config

Ensure these lines are set to yes:

bash
ChallengeResponseAuthentication yes
PasswordAuthentication yes

Or for newer versions:

bash
KbdInteractiveAuthentication yes
PasswordAuthentication yes

Save the file (Ctrl+X, then Y, then Enter in nano), then restart SSH:

bash
sudo systemctl restart ssh
# or
sudo systemctl restart sshd
6Fix SSH directory and authorized_keys permissions

Even if keyboard-interactive is enabled, permission issues can prevent authentication. Set correct permissions:

bash
# Set ~/.ssh directory permissions (700 = read/write/execute for owner only)
chmod 700 ~/.ssh

# Set authorized_keys permissions (600 = read/write for owner only)
chmod 600 ~/.ssh/authorized_keys

# Verify with:
ls -la ~/.ssh/

Output should show:

bash
drwx------  owner  group  .ssh
-rw-------  owner  group  authorized_keys
7Test the connection after server configuration changes

After modifying sshd_config, test the connection:

bash
ssh -o PreferredAuthentications=password,keyboard-interactive username@hostname

You should now be prompted for your password. If you see the password prompt, authentication is working. Enter your credentials.

Advanced notes

Keyboard-interactive vs Password Authentication: These are two distinct SSH authentication methods. "Password" is a simple single-prompt method where the client sends a password without server prompts. "Keyboard-interactive" is more flexible and allows the server to send multiple prompts (labels) and receive multiple responses. Many distributions disable "PasswordAuthentication" by default and rely on "KeyboardInteractive" instead, which can be confusing when you see permission denied errors. PAM Integration: Keyboard-interactive authentication often works with Linux PAM (Pluggable Authentication Modules), which allows complex authentication scenarios including multi-factor authentication. If PAM is configured with specific modules (like for OTP or hardware tokens), those must be satisfied. Check PAM configuration in /etc/pam.d/sshd if keyboard-interactive is enabled but still failing. Security Considerations: If you don't need keyboard-interactive authentication, it's safer to disable it: set both ChallengeResponseAuthentication and PasswordAuthentication to "no" and rely on SSH public key authentication only. This eliminates password-based attack vectors. Windows SSH: Windows OpenSSH (Win32-OpenSSH) can have specific issues with keyboard-interactive. If on Windows, ensure your SSH server is fully updated and consider using WSL2 with native OpenSSH instead. Firewall/Network: Some firewalls or proxies can interfere with the authentication handshake. If keyboard-interactive works locally but not remotely, verify network connectivity and proxy settings. Multi-Factor Authentication: If the server is configured with MFA (multi-factor authentication) via PAM, keyboard-interactive will prompt for multiple pieces of information (password + token code, for example). Ensure you have all required factors when attempting login.

Frequently asked questions

What does "Permission denied (keyboard-interactive)." mean?
This error occurs when SSH cannot authenticate using keyboard-interactive authentication. ) in sequence. When you see this error, it means the server either cannot accept keyboard-interactive authentication at all, or your credentials were rejected.
How do I fix "Permission denied (keyboard-interactive)."?
SSH fails with "Permission denied (keyboard-interactive)" when the server denies authentication attempts using keyboard-interactive methods, often due to authentication method configuration issues, disabled password authentication, or misconfigured authorized_keys.
What causes "Permission denied (keyboard-interactive)."?
Keyboard-interactive authentication is disabled on the SSH server (sshd_config has ChallengeResponseAuthentication no) Password authentication is disabled on the server and keyboard-interactive is the fallback being attempted The authorized_keys file has incorrect permissions (too open or too restrictive)
Is the "Permission denied (keyboard-interactive)." error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading