Raspberry Pi SSH Access Denied

Troubleshooting 'SSH Access Denied' on Raspberry Pi

A comprehensive guide to diagnosing and resolving common 'SSH Access Denied' errors when connecting to your Raspberry Pi, covering configuration, credentials, and network issues.

Encountering an 'SSH Access Denied' error when trying to connect to your Raspberry Pi can be frustrating, especially when you're eager to start a new project or manage an existing one remotely. This issue can stem from a variety of causes, ranging from incorrect credentials and misconfigured SSH settings to network problems or even a corrupted SD card. This article will walk you through the most common reasons for SSH access denial and provide step-by-step solutions to get you back online.

Understanding the SSH Connection Process

Before diving into troubleshooting, it's helpful to understand the basic flow of an SSH connection. This will help you pinpoint where the failure might be occurring. The process involves a client (your computer) attempting to establish a secure shell session with a server (your Raspberry Pi) over a network. Authentication is a critical step, typically involving a username and password, or an SSH key pair.

sequenceDiagram
    participant Client
    participant RaspberryPi

    Client->>RaspberryPi: Connection Request (SSH Port 22)
    RaspberryPi-->>Client: SSH Protocol Version Exchange
    Client->>RaspberryPi: Authentication Request (Username/Password or Key)
    alt Successful Authentication
        RaspberryPi-->>Client: Authentication Accepted
        Client->>RaspberryPi: Session Request
        RaspberryPi-->>Client: Session Established
        Client<->>RaspberryPi: Secure Shell Session
    else Failed Authentication
        RaspberryPi-->>Client: Authentication Denied
        Client->>Client: Display 'Access Denied'
    end

Simplified SSH Connection Flow

Common Causes and Solutions for Access Denied

The 'Access Denied' message is generic, but it usually points to an authentication failure or a server-side configuration issue. Let's explore the most frequent culprits and how to address them.

1. Incorrect Username or Password

This is by far the most common reason for SSH access denied. Raspberry Pi OS (formerly Raspbian) typically uses the default username pi and password raspberry for initial setup. If you've changed these, ensure you're using the correct, updated credentials.

1. Verify Credentials

Double-check the username and password you are entering. Remember that passwords are case-sensitive.

2. Reset Password (if necessary)

If you've forgotten the password, connect a monitor and keyboard to your Raspberry Pi. Log in locally (if possible) and use the passwd command to change the password for the pi user or any other user you intend to SSH with.

passwd pi

Command to change the password for the 'pi' user.

2. SSH Server Not Enabled or Running

By default, SSH is disabled on new Raspberry Pi OS installations for security reasons. You must explicitly enable it.

1. Enable SSH via raspi-config

Connect a monitor and keyboard to your Raspberry Pi. Open a terminal and run sudo raspi-config. Navigate to Interface Options -> P2 SSH -> Yes to enable the SSH server. Reboot your Pi afterwards.

2. Enable SSH via boot partition (headless setup)

If you're setting up headless, you can enable SSH by placing an empty file named ssh (no extension) in the boot partition of the SD card before first boot. The system will automatically enable SSH and delete the file.

3. Check SSH Service Status

From the Raspberry Pi's local terminal, you can verify if the SSH service is running using sudo systemctl status ssh.

sudo raspi-config
sudo systemctl status ssh

Commands to enable and check SSH service status.

3. Incorrect Permissions on SSH Keys (Client Side)

If you're using SSH key-based authentication, incorrect file permissions on your client machine for your private key can cause access denied errors. SSH clients are very strict about this.

1. Set Correct Permissions for Private Key

On your client machine (the one you're SSHing from), navigate to the directory where your private key is stored (e.g., ~/.ssh/id_rsa) and set its permissions to 600 (read/write for owner only).

2. Verify Public Key on Raspberry Pi

Ensure your public key is correctly placed in ~/.ssh/authorized_keys on the Raspberry Pi, and that the ~/.ssh directory has permissions 700 and authorized_keys has 600.

# On your client machine:
chmod 600 ~/.ssh/id_rsa

# On your Raspberry Pi (local access):
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Setting correct permissions for SSH keys.

4. Firewall or Network Issues

Sometimes, the problem isn't with the Pi itself but with network connectivity or firewalls blocking the SSH port (default 22).

1. Check Network Connectivity

Ensure your Raspberry Pi is connected to the network and has an IP address. You can find its IP address using hostname -I on the Pi itself, or by checking your router's connected devices list.

2. Ping the Raspberry Pi

From your client machine, try to ping the Raspberry Pi's IP address to confirm basic network reachability.

3. Check Client Firewall

Temporarily disable your client machine's firewall to see if it's blocking outgoing SSH connections. If it resolves the issue, configure your firewall to allow SSH traffic.

4. Check Raspberry Pi Firewall (UFW)

If you have a firewall like UFW (Uncomplicated Firewall) installed on your Raspberry Pi, ensure it's configured to allow SSH traffic. Use sudo ufw status and sudo ufw allow ssh if needed.

# On Raspberry Pi:
hostname -I

# On client machine:
ping <Raspberry_Pi_IP_Address>

# On Raspberry Pi (if UFW is installed):
sudo ufw status
sudo ufw allow ssh
sudo ufw enable

Network and firewall checks.

5. SSH Configuration File (sshd_config) Issues

Advanced users might have modified the SSH daemon configuration file (/etc/ssh/sshd_config), leading to access problems. Common issues include PermitRootLogin no, PasswordAuthentication no, or AllowUsers restrictions.

1. Review sshd_config

Access your Raspberry Pi locally and open /etc/ssh/sshd_config with a text editor (e.g., sudo nano /etc/ssh/sshd_config). Look for lines that might restrict access.

2. Check PasswordAuthentication

Ensure PasswordAuthentication yes if you intend to use password-based login. If it's set to no, only key-based authentication will work.

3. Check PermitRootLogin

It's generally recommended to keep PermitRootLogin no for security, but if you're trying to log in as root, this setting will prevent it.

4. Check AllowUsers / DenyUsers

If these directives are present, ensure your username is explicitly allowed or not explicitly denied.

5. Restart SSH Service

After any changes to sshd_config, you must restart the SSH service for them to take effect: sudo systemctl restart ssh.

sudo nano /etc/ssh/sshd_config
sudo systemctl restart ssh

Editing SSH daemon configuration and restarting the service.

6. Corrupted SD Card or OS Issues

In rare cases, a corrupted SD card or a damaged operating system installation can lead to SSH service failures or authentication issues. If all else fails, this might be the cause.

1. Check System Logs

Access your Raspberry Pi locally and check system logs for SSH-related errors: journalctl -u sshd or grep sshd /var/log/auth.log.

2. Re-image SD Card

As a last resort, consider backing up any important data and re-imaging your SD card with a fresh Raspberry Pi OS installation. This often resolves deep-seated software issues.

journalctl -u sshd
grep sshd /var/log/auth.log

Checking SSH daemon logs for errors.

By systematically working through these troubleshooting steps, you should be able to identify and resolve the 'SSH Access Denied' error on your Raspberry Pi. Remember to approach the problem methodically, starting with the simplest solutions and moving to more complex ones.