The SSH client failed to find the private key file it was told to use, preventing it from authenticating to the remote server.

This usually happens because the path to your SSH private key is incorrect, the file doesn’t exist where you think it does, or the SSH client is configured to look in the wrong place.

Cause 1: Incorrect Path in ~/.ssh/config

You might have an entry in your ~/.ssh/config file that points to a non-existent or misspelled private key.

  • Diagnosis: Check your SSH config file for the IdentityFile directive for the host you’re trying to connect to.
    cat ~/.ssh/config
    
    Look for a line like IdentityFile ~/.ssh/id_rsa_special.
  • Fix: Correct the path to point to the actual location of your private key, or remove the line if it’s no longer needed. For example, if the key is actually at ~/.ssh/id_rsa, change the line to IdentityFile ~/.ssh/id_rsa.
  • Why it works: The IdentityFile directive explicitly tells ssh which private key to use for authentication. If this path is wrong, ssh can’t find the key and throws the error.

Cause 2: Typo in the SSH Command

If you’re specifying the identity file directly on the command line using the -i flag, a simple typo is a common culprit.

  • Diagnosis: Review the exact ssh command you’re running.
    ssh -i ~/.ssh/my_key_prod user@example.com
    
  • Fix: Ensure the path after -i is accurate and matches the actual filename of your private key. For instance, if your key is named ~/.ssh/my_key_prod.pem, use ssh -i ~/.ssh/my_key_prod.pem user@example.com.
  • Why it works: The -i flag tells ssh to use the specified file as the private key. A typo means ssh is looking for a file that doesn’t exist.

Cause 3: File Doesn’t Exist

The most straightforward reason is that the private key file simply isn’t where ssh expects it to be, or it was accidentally deleted or moved.

  • Diagnosis: Use ls to check if the file exists at the specified path.
    ls -l ~/.ssh/id_rsa
    
    If this command returns nothing or an error, the file is not there.
  • Fix: If the file truly doesn’t exist, you’ll need to recreate it or copy it from a backup. If it was moved, locate it and either move it back or update your ~/.ssh/config or command-line argument to reflect its new location. For example, if you find it in ~/Downloads/id_rsa, you might move it to mv ~/Downloads/id_rsa ~/.ssh/ and ensure permissions are correct (chmod 600 ~/.ssh/id_rsa).
  • Why it works: ssh needs the actual file to exist to read the private key material for authentication.

Cause 4: Incorrect Permissions

While less common for "No Such File or Directory," extremely restrictive permissions can sometimes prevent the client from even seeing the file, though it usually results in a "Permission denied" error. However, it’s good practice to check.

  • Diagnosis: Verify the permissions of your private key file. It should be readable only by you.
    ls -l ~/.ssh/id_rsa
    
    The output should look like -rw------- (600).
  • Fix: Set the correct permissions.
    chmod 600 ~/.ssh/id_rsa
    
  • Why it works: SSH is designed with security in mind. If your private key file is world-readable or group-readable, SSH will refuse to use it to prevent unauthorized access to your private key. While this typically causes a "Permission denied" error, ensuring correct permissions is a critical step in SSH key management.

Cause 5: SSH Agent Not Running or Key Not Added

If you rely on ssh-agent to manage your keys, and the agent isn’t running or the specific key hasn’t been added, ssh might fall back to looking for default key files and fail if they don’t exist or are misconfigured.

  • Diagnosis: Check if the ssh-agent is running and if your key is loaded.
    ssh-add -l
    
    If this command shows "The agent has no identities" or returns an error, the agent isn’t set up or doesn’t have your key.
  • Fix: Start the agent (if not running) and add your key.
    eval "$(ssh-agent -s)"
    ssh-add ~/.ssh/id_rsa
    
    Enter your passphrase when prompted.
  • Why it works: ssh-agent holds your decrypted private keys in memory, and ssh clients can query the agent for keys to use, avoiding the need to specify them directly or rely on default file locations. If the agent isn’t running or the key isn’t added, ssh won’t find the key through this mechanism.

Cause 6: Incorrect Default Key Location

SSH looks for default private key files in ~/.ssh/ if no specific IdentityFile is provided and no key is loaded in ssh-agent. Common default names include id_rsa, id_dsa, id_ecdsa, id_ed25519. If you’ve renamed your key or are using a non-standard name without configuring ssh, it won’t be found.

  • Diagnosis: List the contents of your ~/.ssh directory.
    ls -l ~/.ssh
    
    Check if any of the standard private key filenames (id_rsa, etc.) exist.
  • Fix: Either rename your private key to one of the standard names (e.g., mv ~/.ssh/my_special_key ~/.ssh/id_rsa) or, preferably, configure your ~/.ssh/config file to explicitly point to your custom-named key using the IdentityFile directive (as shown in Cause 1).
  • Why it works: SSH has a built-in search order for default private keys. If your key isn’t named according to these defaults and isn’t explicitly configured, SSH won’t know to use it.

After fixing the identity file issue, you’ll likely encounter a "Permission denied (publickey)" error if your public key isn’t correctly installed on the server or if the server’s SSH configuration disallows public key authentication.

Want structured learning?

Take the full Ssh course →