How to fix Permission denied (publickey,keyboard-interactive). in SSH

First, check that you have SSH keys generated on your local machine:

ls -la ~/.ssh/

You should see files like id_rsa (private key) and id_rsa.pub (public key). If these files don't exist, generate a new SSH key:

ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N ""

This creates a 4096-bit RSA key pair without a passphrase (use a passphrase for security).

Incorrect permissions on your private key will cause SSH to refuse it. Set the correct permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub

Verify the permissions:

ls -la ~/.ssh/

You should see:
- drwx------ (700) for the ~/.ssh directory
- -rw------- (600) for id_rsa
- -rw-r--r-- (644) for id_rsa.pub

Your public key must be on the server in the authorized_keys file. The easiest way is using ssh-copy-id:

ssh-copy-id -i ~/.ssh/id_rsa.pub username@remote-host

If ssh-copy-id is not available, manually copy the key:

cat ~/.ssh/id_rsa.pub | ssh username@remote-host 'cat >> ~/.ssh/authorized_keys'

Replace username with your actual username and remote-host with the server address.

Log into the server (if possible with a different method) and check permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys.d/*

Verify:

ls -la ~/.ssh/

The ~/.ssh directory should be 700, and authorized_keys should be 600. Incorrect permissions are a common cause of this error.

On the server, check that your public key is in the authorized_keys file:

cat ~/.ssh/authorized_keys

You should see your public key content (starts with 'ssh-rsa' or 'ssh-ed25519'). If it's not there, add it:

echo 'your-public-key-content' >> ~/.ssh/authorized_keys

You can also verify by comparing fingerprints. On your client:

ssh-keygen -lf ~/.ssh/id_rsa.pub

On the server:

ssh-keygen -lf ~/.ssh/authorized_keys

The fingerprints should match.

Log into the server and check /etc/ssh/sshd_config:

sudo nano /etc/ssh/sshd_config

Ensure these settings are present and uncommented (no # at the start):

PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
KbdInteractiveAuthentication yes

For older SSH versions, use ChallengeResponseAuthentication yes instead of KbdInteractiveAuthentication. After making changes, reload SSH:

sudo systemctl restart sshd

Or:

sudo service ssh restart

Run SSH with verbose mode to see exactly where authentication fails:

ssh -vvv username@remote-host

Look for lines like:
- Trying private key - shows which keys are being tried
- Authentications that can continue - lists methods the server accepted
- Permission denied - where the failure occurs

Verbose output will tell you whether the issue is with key matching, permissions, or server configuration.

Verify your SSH agent is running and has the key loaded:

eval "$(ssh-agent -s)"
ssh-add -l

This should list your key with its fingerprint. If nothing is listed, add your key:

ssh-add ~/.ssh/id_rsa

For macOS, use:

ssh-add --apple-use-keychain ~/.ssh/id_rsa

If your key has a passphrase, you'll be prompted to enter it.