How to fix sign_and_send_pubkey: signing failed for RSA from agent: agent refused operation in SSH

The most common cause is private key files with overly open permissions. Check your key permissions:

ls -l ~/.ssh/id_rsa

The output should show: -rw------- 1 user user (which is 0600 or 600 in octal).

If permissions are more open (for example -rw-r--r-- or -rwxrwxrwx), fix them immediately:

chmod 600 ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_ecdsa

Also ensure ~/.ssh directory itself has correct permissions:

chmod 700 ~/.ssh

After fixing permissions, the agent should accept the key for signing.

After fixing permissions, re-add the key to the SSH agent:

ssh-add ~/.ssh/id_rsa

If your key is password-protected, you'll be prompted to enter the passphrase.

To verify the key is now properly loaded:

ssh-add -l

This lists all keys the agent knows about. Your key should appear without any warnings.

If permissions are correct but the agent still refuses operations, the agent process may be stuck. Kill and restart it:

pkill ssh-agent
eval $(ssh-agent -s)

Then re-add your key:

ssh-add ~/.ssh/id_rsa

Try your SSH connection again.

If you're using a hardware security key, the error may indicate the key requires physical confirmation (tap/touch):

ssh-add ~/.ssh/id_rsa  # Add the key
ssh [email protected]      # Attempt connection, watch for confirmation prompt

When prompted, physically confirm on your hardware key (press button, tap sensor, etc.). If using YubiKey over SSH, ensure you tap the key when the authentication prompt appears.

If the agent shows "no identities" even after adding the key:

ssh-add -l

Your hardware key vendor may require additional configuration. Check their SSH integration documentation.

As a temporary workaround, you can skip the SSH agent and use the key directly:

ssh -o IdentityAgent=none -i ~/.ssh/id_rsa [email protected]

This tells SSH to ignore the agent and authenticate directly with the specified key file. This works only if the key file permissions are correct (600) and the key is not password-protected (or you accept being prompted for the passphrase).

To make this permanent for all connections, add it to ~/.ssh/config:

Host *
  IdentityAgent none

Note: This disables agent forwarding, which some workflows rely on.

If your SSH key is encrypted with a passphrase, the agent should prompt you when you add it. However, some SSH clients don't support password prompts in non-interactive sessions.

To check if your key is password-protected:

head -2 ~/.ssh/id_rsa

If the second line says Proc-Type: 4,ENCRYPTED, your key is password-protected.

For automated SSH (CI/CD, scripts), use an unencrypted key or an SSH agent that's already loaded:

# Load key with passphrase once
ssh-add ~/.ssh/id_rsa
# Then use SSH commands without prompts (agent handles authentication)

Alternatively, generate an unencrypted key for automation (store safely!):

ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_automation -N ""

Ensure the public key on your local machine matches what's configured on the remote server:

cat ~/.ssh/id_rsa.pub

Copy this output and verify it exists on the remote host in ~/.ssh/authorized_keys:

ssh [email protected] "grep 'YOUR_PUBLIC_KEY_HERE' ~/.ssh/authorized_keys"

If the public key is not listed, add it:

cat ~/.ssh/id_rsa.pub | ssh [email protected] 'cat >> ~/.ssh/authorized_keys'

After verifying/updating authorized_keys, permissions on the remote side also matter:

ssh [email protected] "chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys"