Unable to ssh on RPI5 "Permission denied (publickey,gssapi-keyex,gssapi-with-mic)"

Greetings. I recently set up AlmaLinux 9.5 (no DE, gpt image) on my Raspberry Pi 5. All I’ve done thus far is add a user with sudo privileges, changed the hostname, and added the epel-release to access additional packages.

However, I’m running into an issue when I try to ssh. I receive the following error when I ssh from my laptop:

ssh chuck@192.168.1.20 Permission denied (publickey,gssapi-keyex,gssapi-with-mic)

Some things I’ve tried:

  • I’ve created authorized_keys file in the .ssh folder, giving the permissions of 700 to the .ssh folder, and 600 to the authorized_keys file. I’ve then restarted sshd.
  • I’ve generated ssh keys via ssh-keygen -t rsa -b 4096 -C "chuck", then appended the id_rsa.pub into the authorized_keys file, and restarted sshd.
  • In /etc/ssh/sshd_config I’ve set “PasswordAuthentication yes” and “PubkeyAuthentication yes”, then restarted the sshd service.
  • Verified the password is correct for the new user account. I’ve also had this same error trying to ssh via the default ‘almalinux’ user account.
  • I installed the default GNOME variant to test everything, but I was still unable to ssh, receiving the same error.
  • I can ping the RPI5 IP address (192.168.1.20).
  • I can ssh from the RPI5 into another server on my network, but not the other way around.
  • I’ve made sure ssh is allowed through the firewall with sudo firewall-cmd --permanent --add-service=ssh (I received “WARNING: ALREADY_ENABLED: ssh”) and then reloaded with sudo firewall-cmd --reload

Regardless of what I do, I still get “Permission denied (publickey,gssapi-keyex,gssapi-with-mic)”. I feel like I’m doing something wrong with the ssh keys, but I don’t know what. Any suggestions would be appreciated. Thanks!

Check /etc/ssh/sshd_config.d/50-rechat.conf

Set ChallengeResponseAuthentication to yes.

I think the proper way to fix it is to have a different numbered file (but higher or lower I don’t know). I just edited that one.

1 Like

Thank you, kind stranger! This was the solution! I really appreciate the help.

For those stumbling across this, I had to create the file /etc/ssh/sshd_config.d/50-rechat.conf and I added the line ChallengeResponseAuthentication yes.