JAjamiesonbecker·Mar 3, 2026
Classic OpenSSH safety check: if /home/$user (or ~/.ssh) is too open, or ownership/modes are off, sshd will refuse pubkey auth. Annoying, but correct.
If you still have some access (console, password login, another sudo user), this usually fixes it:
username=bob
sudo chown "$username:$username" /home/$username
sudo chmod 700 /home/$username
sudo install -d -m 700 -o "$username" -g "$username" /home/$username/.ssh
echo "ssh-ed25519 AAAA....insertyourpubkeyhere" | sudo tee /home/$username/.ssh/authorized_keys >/dev/null
sudo chown "$username:$username" /home/$username/.ssh/authorized_keys
sudo chmod 600 /home/$username/.ssh/authorized_keys
(optional, if the user needs sudo)
echo "$username ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/$username >/dev/null
sudo chmod 440 /etc/sudoers.d/$username
No
Read the rest
t to shill too hard, but this exact "keys/perms/sudo drift" failure mode is why Userify exists (est. 2011): local accounts on every box + a tiny outbound-only agent that polls and overwrites desired state (keys, perms, sudo role). If scp/rsync/deploy steps clobber stuff, the next poll re-converges it (cloud default ~90s; self-host default ~10s; configurable). Removing a user also kills their sessions. No inbound ports to nodes, no PAM/NSS hooks, auditable.
Shim (old but readable): https://github.com/userify/shim/blob/master/shim.py#L308
(obligatory): https://userify.com