# Balena ssh fails with Permission denied (publickey) **URL:** \ **Category:** balenaOS\ **Created:** [January 2, 2019, 2:08am UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863 "2019-01-02T02:08:57Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![rlev](https://avatars.discourse-cdn.com/v4/letter/r/b5ac83/32.png) [@rlev](https://forums.balena.io/u/rlev)\ **Post date:** [January 2, 2019, 2:08am UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863/1 "2019-01-02T02:08:58Z")
open-balena is used in the backend. I can login and get information about a specific devices using balena-cli : $ balena device 79a1dd9 == HIDDEN SKY ID: 8 DEVICE TYPE: imx6ul-var-dart STATUS: idle IS ONLINE: true APPLICATION NAME: imx6ulApp UUID: 79a1dd9c1bacdc79661d1afd31e7c52b COMMIT: fc2e2716d8c8913ae434a0f05f9ed713 SUPERVISOR VERSION: 8.6.3 OS VERSION: balenaOS 2.28.0+rev2 DASHBOARD URL: [https://dashboard.mydomain.com/devices/79a1dd9c1bacdc79661d1afd31e7c52b/summary](https://dashboard.mydomain.com/devices/79a1dd9c1bacdc79661d1afd31e7c52b/summary) But when try to ssh to host BalenaOS : $ balena ssh 79a1dd9 -s Connecting to: 79a1dd9 [root@ssh.devices.mydomain.com](mailto:root@ssh.devices.mydomain.com): Permission denied (publickey). ---
**Author:** ![dash](https://avatars.discourse-cdn.com/v4/letter/d/7c8e57/32.png) [@dash](https://forums.balena.io/u/dash)\ **Post date:** [January 2, 2019, 3:25am UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863/2 "2019-01-02T03:25:28Z")
Hi @rlev Use the development version, login and take a look at authorized keys on device: ``` $ vi ~/.ssh/authorized_keys_remote ``` It will be empty I’m pretty sure. I have this exact same issue and am trying to work what key should be included and at what point it should be created on the open-balena host, and how it is added to device. I suspect the authorised pub key that needs to be added is from the open balena host but it is unclear if this needs to be generated manually or exists after executing setup script to create certificates etc. Hopefully open balena team will be back from holidays soon and be able to shed more light on this. Cheers Chris ---
**Author:** ![dash](https://avatars.discourse-cdn.com/v4/letter/d/7c8e57/32.png) [@dash](https://forums.balena.io/u/dash)\ **Post date:** [January 2, 2019, 4:33am UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863/3 "2019-01-02T04:33:11Z")
Just a little further background on this. I have tried adding SSH key with: ``` $ balena key add Main ~/.ssh/id_rsa.pub BalenaRequestError: Request error: Unauthorized ``` Also listing keys doesn’t work with: ``` $ balena keys BalenaRequestError: Request error: Internal Server Error ``` Other cli commands for listing devices, viewing logs, and modifying applications are working with this openBalena instance. This might be a bigger issue than I thought. Can probably work out how to manually add a key to the right spot, will let you know if I work it out @rlev . In the meantime this will probably have to wait for a patch along with all of the other cli issues when using openBalena instance. Cheers Chris ---
**Author:** ![rlev](https://avatars.discourse-cdn.com/v4/letter/r/b5ac83/32.png) [@rlev](https://forums.balena.io/u/rlev)\ **Post date:** [January 3, 2019, 1:56am UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863/4 "2019-01-03T01:56:40Z")
Thanks for your insights @dash. ---
**Author:** ![james.eberhardt](https://avatars.discourse-cdn.com/v4/letter/j/b19c9b/32.png) [@james.eberhardt](https://forums.balena.io/u/james.eberhardt)\ **Post date:** [April 3, 2019, 5:22pm UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863/5 "2019-04-03T17:22:49Z")
I just wanted to say that the following command worked for me on a Mac. > balena key add Main ~/.ssh/id\_rsa.pub ---
**Author:** ![pietro](https://avatars.discourse-cdn.com/v4/letter/p/47e85d/32.png) [@pietro](https://forums.balena.io/u/pietro)\ **Post date:** [May 29, 2019, 6:56pm UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863/8 "2019-05-29T18:56:03Z")
if you use the production version, you can mount the `balena.img` with `losetup -P` the mount `rw` the `resin-boot` volume, add your key to the file `config.json`. umount, flash your sd card : profit. It took me a short while to figure this out. ---
**Author:** ![pdcastro](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/pdcastro/32/1264_2.png) [@pdcastro](https://forums.balena.io/u/pdcastro)\ **Post date:** [May 29, 2019, 10:59pm UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863/11 "2019-05-29T22:59:15Z")
Having seen activity in this thread… I understand that: - The approach described by Pietro (adding a ssh key to the `config.json` file) would allow “standard ssh” (rather than “balena ssh”) to work. The `sshKeys` entry in `config.json` is described on this page: [https://github.com/balena-os/meta-balena/#sshkeys](https://github.com/balena-os/meta-balena/#sshkeys) - The `"balena key"`, `"balena keys"` and `"balena ssh"` commands don’t currently work with **openBalena.** See this other forum thread for further advice on how to ssh to devices on openBalena: [HowTo: SSH into host device](https://forums.balena.io/t/howto-ssh-into-host-device/5312) ---
**Author:** ![test](https://avatars.discourse-cdn.com/v4/letter/t/f9ae1b/32.png) [@test](https://forums.balena.io/u/test)\ **Post date:** [October 28, 2019, 6:54pm UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863/13 "2019-10-28T18:54:15Z")
all these things are bullshit. logged in and added keys. noting works ---
**Author:** ![nick-rozanski](https://avatars.discourse-cdn.com/v4/letter/n/b2d939/32.png) [@nick-rozanski](https://forums.balena.io/u/nick-rozanski)\ **Post date:** [April 12, 2020, 2:37pm UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863/14 "2020-04-12T14:37:13Z")
Three things to check if SSH is not working: 1. Check that the SSH key has been uploaded to balena (Preferences -\> SSH keys). Take a copy of the key. 2. Check that the public key file ~/.ssh/id\_rsa.pub exists, and has the same contents as the uploaded key from check 1. 3. Check that you have a private key file ~/.ssh/id\_rsa which corresponds to the public key you checked in check 2. This got balena ssh working for me on MacOS. (The key creation command is ssh-keygen -t rsa) ---
**Author:** ![PackElend](https://avatars.discourse-cdn.com/v4/letter/p/90ced4/32.png) [@PackElend](https://forums.balena.io/u/PackElend)\ **Post date:** [January 21, 2022, 6:28am UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863/17 "2022-01-21T06:28:14Z")
Hi, I trying [balena-io-playground/ssh-key-insert: Tooling to insert the relevant SSH keys into balena devices’ configuration. (github.com)](https://github.com/balena-io-playground/ssh-key-insert) but it is driving me nuts. What key shall be added to > [@nick-rozanski](#): > > - Check that the SSH key has been uploaded to balena (Preferences → SSH keys). Take a copy of the key. I reckon the public one. I still get ```auto $ bash -x ./run.sh + cat batch + stdbuf -oL xargs '-I{}' -P 10 /bin/sh -c 'grep -a -q '\''{} : DONE'\'' sshkey.log || (cat add-ssh-key.sh | balena ssh {} | sed '\''s/^/{} : /'\'' | tee --append sshkey.log)' ...@ssh.balena-devices.com: Permission denied (publickey). Warning: ssh process exited with non-zero code "255" Are the SSH keys correctly configured in balenaCloud? See: https://www.balena.io/docs/learn/manage/ssh-access/#add-an-ssh-key-to-balenacloud Are you accidentally using `sudo`? ``` ---
**Author:** ![pdcastro](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/pdcastro/32/1264_2.png) [@pdcastro](https://forums.balena.io/u/pdcastro)\ **Post date:** [January 28, 2022, 12:58pm UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863/18 "2022-01-28T12:58:12Z")
> I reckon the public one @PackElend, the public key, yes. Balena only ever needs to have the public key. The private key stays in your workstation, `~/.ssh/` directory. > I trying `balena-io-playground/ssh-key-insert` To help diagnose the issue, try enabling ssh’s verbose output. Edit the `run.sh` script: Where it reads “balena ssh”, replace it with “balena ssh -v”. It’s a long shot, but if the verbose output prints “no mutual signature algorithm”, check this balena CLI issue: [balena ssh fails with error: "no mutual signature algorithm" · Issue #2373 · balena-io/balena-cli · GitHub](https://github.com/balena-io/balena-cli/issues/2373) Another thing you may want to double check is that you are using the same balenaCloud account (same username) when logging in to the web dashboard (through which you added the public SSH key(s)) and when logging in to the balena CLI. Check that the output of the `balena whoami` command matches the balenaCloud web dashboard username: On the web dashboard, click your name at the top-right corner of the window to raise a pop-up menu that shows your username. Note that it is **not** necessary to use the `ssh-key-insert` script and it is **not** necessary to add ssh keys to the `config.json` file in order to use the `balena ssh ` command, regardless of whether the device is running a production or development variant of balenaOS. Additional, custom ssh keys added to the `config.json` file through the `ssh-key-insert` script (or by manually editing it) allow the balenaCloud proxy backend to be bypassed and a standalone ssh client to be used (instead of the balena CLI) to establish a direct ssh connection from a user’s workstation to a device running a production variant of balenaOS, using the device’s IP address or hostname as the ssh target and ‘root’ as the ssh username. This may be useful, for example, if the device loses access to the internet (perhaps on a schedule) but a workstation is on the same local network as the device (same WiFi access point or Ethernet switch). Note: this answer was edited to clarify the scenario in which the `ssh-key-insert` may be useful. ---
**Author:** ![pdcastro](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/pdcastro/32/1264_2.png) [@pdcastro](https://forums.balena.io/u/pdcastro)\ **Post date:** [March 21, 2022, 5:27pm UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863/19 "2022-03-21T17:27:56Z")
For information, balena CLI v13.3.0 or later also allows `balena ssh ` to be used with **production** variants of balenaOS **without** the need of adding a ssh key to the `config.json` file. This requires the device to be running balenaOS v2.44.0 or later. The combinations are: | Command | balenaOS (dev) | balenaOS (prod) \< v2.44.0 | balenaOS (prod) \>= v2.44.0 | | --- | --- | --- | --- | | `balena ssh ` | OK ✔ | OK ✔ | OK ✔ | | `balena ssh ` | OK ✔ | SSH key needs to be added to `config.json` | OK ✔ (CLI v13.3.0 or later) | Also for information, on Windows, note that the balena CLI makes use of the Microsoft’s built-in ssh client that ships with Windows 10 or later. It is **not** compatible with PuTTY. Check the following answer for more details: [add SSH key after provisioning to production device? - #10 by pdcastro](https://forums.balena.io/t/add-ssh-key-after-provisioning-to-production-device/350886/10) ---
**Author:** ![yeloman](https://avatars.discourse-cdn.com/v4/letter/y/ba9def/32.png) [@yeloman](https://forums.balena.io/u/yeloman)\ **Post date:** [November 30, 2022, 6:45pm UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863/21 "2022-11-30T18:45:34Z")
```auto PS C:\Users\Den> ssh -p 22222 10.91.102.253 -v OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2 debug1: Reading configuration data C:\\Users\\Den/.ssh/config debug1: Connecting to 10.91.102.253 [10.91.102.253] port 22222. debug1: Connection established. debug1: identity file C:\\Users\\Den/.ssh/id_rsa type 0 debug1: identity file C:\\Users\\Den/.ssh/id_rsa-cert type -1 debug1: identity file C:\\Users\\Den/.ssh/id_dsa type -1 debug1: identity file C:\\Users\\Den/.ssh/id_dsa-cert type -1 debug1: identity file C:\\Users\\Den/.ssh/id_ecdsa type -1 debug1: identity file C:\\Users\\Den/.ssh/id_ecdsa-cert type -1 debug1: identity file C:\\Users\\Den/.ssh/id_ed25519 type -1 debug1: identity file C:\\Users\\Den/.ssh/id_ed25519-cert type -1 debug1: identity file C:\\Users\\Den/.ssh/id_xmss type -1 debug1: identity file C:\\Users\\Den/.ssh/id_xmss-cert type -1 debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.1 debug1: Remote protocol version 2.0, remote software version OpenSSH_8.9 debug1: match: OpenSSH_8.9 pat OpenSSH* compat 0x04000000 debug1: Authenticating to 10.91.102.253:22222 as 'den' debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: algorithm: curve25519-sha256 debug1: kex: host key algorithm: ecdsa-sha2-nistp256 debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: compression: none debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: compression: none debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ecdsa-sha2-nistp256 SHA256:qwbLBNYPdxNW7shUuf40T+nbopajc2bTMme9cKoSKl8 debug1: Host '[10.91.102.253]:22222' is known and matches the ECDSA host key. debug1: Found key in C:\\Users\\Den/.ssh/known_hosts:6 debug1: rekey out after 134217728 blocks debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: rekey in after 134217728 blocks debug1: pubkey_prepare: ssh_get_authentication_socket: No such file or directory debug1: Will attempt key: C:\\Users\\Den/.ssh/id_rsa RSA SHA256:B2EX6/h7O1g7B5B8r2nFd/glARxOgtqn/UMksMVR7Dg debug1: Will attempt key: C:\\Users\\Den/.ssh/id_dsa debug1: Will attempt key: C:\\Users\\Den/.ssh/id_ecdsa debug1: Will attempt key: C:\\Users\\Den/.ssh/id_ed25519 debug1: Will attempt key: C:\\Users\\Den/.ssh/id_xmss debug1: SSH2_MSG_EXT_INFO received debug1: kex_input_ext_info: server-sig-algs= debug1: kex_input_ext_info: publickey-hostbound@openssh.com (unrecognised) debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey debug1: Next authentication method: publickey debug1: Offering public key: C:\\Users\\Den/.ssh/id_rsa RSA SHA256:B2EX6/h7O1g7B5B8r2nFd/glARxOgtqn/UMksMVR7Dg debug1: Authentications that can continue: publickey debug1: Trying private key: C:\\Users\\Den/.ssh/id_dsa debug1: Trying private key: C:\\Users\\Den/.ssh/id_ecdsa debug1: Trying private key: C:\\Users\\Den/.ssh/id_ed25519 debug1: Trying private key: C:\\Users\\Den/.ssh/id_xmss debug1: No more authentication methods to try. den@10.91.102.253: Permission denied (publickey). ``` Still testing direct SSH on production image. Testet config.json | jq and all seem correct after adding the ssh-keys. Still getting permission denied Any clue for the verbose output above? I’m able to balena ssh but this is still way too slow, so I’m still pushing to SSH directly through local connection. ---
**Author:** ![alexgg](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@alexgg](https://forums.balena.io/u/alexgg)\ **Post date:** [December 29, 2022, 12:24pm UTC](https://forums.balena.io/t/balena-ssh-fails-with-permission-denied-publickey/4863/22 "2022-12-29T12:24:08Z")
Hi, Assuming you are using a production image, you will first need to copy the ssh public key into `config.json` as detailed in [meta-balena/README.md at master · balena-os/meta-balena · GitHub](https://github.com/balena-os/meta-balena/blob/master/README.md#sshkeys). Then you can try to run ssh by specifying both the user and the key: `ssh -p 22222 -i root@10.91.102.253 -v`