{"id":41,"date":"2026-07-14T00:00:00","date_gmt":"2026-07-14T00:00:00","guid":{"rendered":"http:\/\/\/var\/www\/html\/?p=41"},"modified":"2026-07-21T01:02:32","modified_gmt":"2026-07-21T01:02:32","slug":"git-error-permission-denied-publickey-ssh-key-agent-missing-on-ubuntu-2204-lts","status":"publish","type":"post","link":"https:\/\/butitworkedlocal.com\/git-error-permission-denied-publickey-ssh-key-agent-missing-on-ubuntu-2204-lts\/","title":{"rendered":"Fixing Git ‘Permission Denied (publickey)’ with SSH Agent on Ubuntu 22.04 LTS"},"content":{"rendered":"\n

Resolve Git 'Permission Denied (publickey)' errors on Ubuntu 22.04 LTS by troubleshooting SSH key agent issues, ensuring correct key setup, and proper Git host authentication.<\/strong><\/p>\n\n\n

When working with Git repositories over SSH, encountering a "Permission Denied (publickey)" error can halt your development or deployment workflows. This issue often signals a problem with how your SSH client (on Ubuntu 22.04 LTS) is presenting its authentication credentials (your SSH private key) to the remote Git server (e.g., GitHub, GitLab, Bitbucket). The error message "SSH key agent missing" further points to the ssh-agent<\/code> utility, which is responsible for securely managing your private keys in memory.<\/p>\n

Symptom & Error Signature<\/h3>\n

You will typically encounter this error when attempting to perform Git operations that require authentication with a remote server via SSH, such as git clone<\/code>, git push<\/code>, or git pull<\/code>.<\/p>\n

The output in your terminal might look similar to one of these:<\/p>\n

git@github.com: Permission denied (publickey).\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\n<\/code><\/pre>\n
Or, with a more explicit "agent missing" hint (though this part is often inferred rather than explicitly stated by Git itself, ssh<\/code> might report it with verbose output):<\/p>\n
Cloning into 'my-repository'...\ngit@gitlab.com: Permission denied (publickey).\nThe authenticity of host 'gitlab.com (X.X.X.X)' can't be established.\nED25519 key fingerprint is SHA256:....\nThis key is not known by any other names\nAre you sure you want to continue connecting (yes\/no\/[fingerprint])? yes\nWarning: Permanently added 'gitlab.com' (ED25519) to the list of known hosts.\ngit@gitlab.com: Permission denied (publickey).\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\n<\/code><\/pre>\n
In some verbose scenarios, you might see Agent admitted failure to sign using the key.<\/code> or no mutual signature algorithm<\/code> if the agent is running but lacks the correct key.<\/p>\n
Root Cause Analysis<\/h3>\n
The "Permission Denied (publickey)" error, especially when combined with issues related to the ssh-agent<\/code>, stems from one or more of the following underlying problems:<\/p>\n
    \n
  1. Missing or Unloaded Private Key:<\/strong> Your SSH private key (id_rsa<\/code>, id_ed25519<\/code>, etc.) is either not present on your system, or it exists but has not been added to your ssh-agent<\/code> for use. The ssh-agent<\/code> acts as a key manager, allowing ssh<\/code> and git<\/code> to use your keys without repeatedly asking for passphrases.<\/li>\n
  2. ssh-agent<\/code> Not Running or Misconfigured:<\/strong> The ssh-agent<\/code> process, which holds your keys in memory, might not be running in your current shell session, or it may not have been correctly configured to start automatically with your desktop environment or terminal session.<\/li>\n
  3. Incorrect Private Key Permissions:<\/strong> SSH keys require strict file permissions (typically 600<\/code> for the private key and 700<\/code> for the .ssh<\/code> directory). If permissions are too liberal, ssh<\/code> will refuse to use the key for security reasons.<\/li>\n
  4. Public Key Not Registered with Git Hosting Service:<\/strong> Even if your private key is correctly set up locally, the corresponding public key (id_rsa.pub<\/code>, id_ed25519.pub<\/code>) must be uploaded and registered with your Git hosting provider (GitHub, GitLab, Bitbucket) for your user account. The remote server uses this public key to verify your identity.<\/li>\n
  5. Incorrect Git Remote URL:<\/strong> You might be attempting to use an HTTPS remote URL (e.g., https:\/\/github.com\/user\/repo.git<\/code>) instead of an SSH URL (e.g., git@github.com:user\/repo.git<\/code>). SSH authentication only works with SSH-formatted remote URLs.<\/li>\n
  6. ~\/.ssh\/config<\/code> Issues:<\/strong> If you have a custom SSH configuration file (~\/.ssh\/config<\/code>), it might be misconfigured, pointing to the wrong key, or overriding necessary default behaviors.<\/li>\n
  7. Key Passphrase Not Provided:<\/strong> If your private key is encrypted with a passphrase, and the ssh-agent<\/code> is not running or the passphrase wasn't provided when adding the key to the agent, authentication will fail.<\/li>\n<\/ol>\n
    Step-by-Step Resolution<\/h3>\n
    Follow these steps sequentially to diagnose and resolve the "Permission Denied (publickey)" error.<\/p>\n
    1. Verify SSH Key Existence and Permissions<\/h4>\n
    First, ensure you have an SSH key pair and that its permissions are correctly set.<\/p>\n
      \n
    1. Check for existing keys:<\/strong><\/p>\n
      ls -al ~\/.ssh\/\n<\/code><\/pre>\n
      Look for files like id_rsa<\/code>, id_rsa.pub<\/code>, id_ed25519<\/code>, id_ed25519.pub<\/code>. If you see only .pub<\/code> files or no id_*<\/code> files, you might not have a key.<\/p>\n<\/li>\n
    2. If no key exists, generate a new one:<\/strong><\/p>\n
      ssh-keygen -t ed25519 -C "your_email@example.com"\n<\/code><\/pre>\n
      ed25519<\/code> is the recommended modern key type. You can use rsa<\/code> with -b 4096<\/code> for older compatibility if needed.\nWhen prompted for a file to save the key, press Enter<\/code> to accept the default (~\/.ssh\/id_ed25519<\/code>).\nAlways set a strong passphrase for your private key.<\/strong> This encrypts your private key at rest, adding a crucial layer of security.<\/p>\n<\/blockquote>\n<\/li>\n
    3. Set correct permissions for your .ssh<\/code> directory and keys:<\/strong><\/p>\n
      chmod 700 ~\/.ssh\nchmod 600 ~\/.ssh\/id_ed25519 # Or id_rsa if you use RSA\nchmod 644 ~\/.ssh\/id_ed25519.pub # Or id_rsa.pub\n<\/code><\/pre>\n
      Incorrect permissions are a very common cause of SSH authentication failures. The private key must<\/em> only be readable by the owner.<\/p>\n<\/blockquote>\n<\/li>\n<\/ol>\n
      2. Start ssh-agent<\/code> and Add Your Private Key<\/h4>\n
      The ssh-agent<\/code> process is key to managing your SSH identities.<\/p>\n
        \n
      1. Check if ssh-agent<\/code> is running:<\/strong><\/p>\n
        eval "$(ssh-agent -s)"\n<\/code><\/pre>\n
        If it's already running, it will output something like SSH_AUTH_SOCK=\/tmp\/ssh-XXXXXX\/agent.YYYY; export SSH_AUTH_SOCK; SSH_AGENT_PID=ZZZZZ; export SSH_AGENT_PID; echo Agent pid ZZZZZ;<\/code>. If it wasn't running, this command will start it and set the necessary environment variables.<\/p>\n<\/li>\n
      2. Add your private key to ssh-agent<\/code>:<\/strong><\/p>\n
        ssh-add ~\/.ssh\/id_ed25519 # Use the path to your private key\n<\/code><\/pre>\n
        If your key has a passphrase, you will be prompted to enter it.\nIf you have multiple keys, add them all.\nYou can check which keys are loaded with ssh-add -l<\/code>.<\/p>\n
        On Ubuntu, ssh-agent<\/code> is often started automatically with your desktop environment. However, it might not be running in a specific terminal session, or it might not have your key loaded. The eval "$(ssh-agent -s)"<\/code> and ssh-add<\/code> commands are typically needed once per session or set up for persistence.<\/p>\n<\/blockquote>\n<\/li>\n<\/ol>\n
        3. Verify Public Key on Git Hosting Service<\/h4>\n
        Your remote Git server needs to know your public key to authenticate you.<\/p>\n
          \n
        1. Copy your public key to clipboard:<\/strong><\/p>\n
          cat ~\/.ssh\/id_ed25519.pub\n<\/code><\/pre>\n
          Copy the entire output, starting with ssh-ed25519<\/code> (or ssh-rsa<\/code>) and ending with your email address.<\/p>\n<\/li>\n
        2. Add the public key to your Git hosting provider:<\/strong><\/p>\n
            \n
          • GitHub:<\/strong> Go to Settings<\/code> -> SSH and GPG keys<\/code> -> New SSH key<\/code>. Paste your public key.<\/li>\n
          • GitLab:<\/strong> Go to User Settings<\/code> -> SSH Keys<\/code>. Paste your public key.<\/li>\n
          • Bitbucket:<\/strong> Go to Profile settings<\/code> -> SSH keys<\/code>. Add key.<\/li>\n
          • Self-hosted Git (e.g., Gitea, plain Git):<\/strong> You'll typically add it to the ~\/.ssh\/authorized_keys<\/code> file of the git<\/code> user on the server.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n
            4. Validate Git Remote URL<\/h4>\n
            Ensure your local Git repository is configured to use the SSH remote URL, not HTTPS.<\/p>\n
              \n
            1. Check current remote URLs:<\/strong>\nNavigate to your repository directory and run:<\/p>\n
              git remote -v\n<\/code><\/pre>\n
              Look for URLs starting with git@<\/code> (SSH) rather than https:\/\/<\/code>.<\/p>\n
              Example of an SSH URL:<\/strong><\/p>\n
              origin  git@github.com:your_username\/your_repository.git (fetch)\norigin  git@github.com:your_username\/your_repository.git (push)\n<\/code><\/pre>\n
              Example of an HTTPS URL (which will cause issues):<\/strong><\/p>\n
              origin  https:\/\/github.com\/your_username\/your_repository.git (fetch)\norigin  https:\/\/github.com\/your_username\/your_repository.git (push)\n<\/code><\/pre>\n<\/li>\n
            2. Change remote URL to SSH if necessary:<\/strong>\nIf you're using an HTTPS URL, update it to SSH:<\/p>\n
              git remote set-url origin git@github.com:your_username\/your_repository.git\n<\/code><\/pre>\n
              Replace your_username\/your_repository.git<\/code> with your actual repository path.<\/p>\n<\/li>\n<\/ol>\n
              5. Test SSH Connection<\/h4>\n
              Test your SSH connection to the Git hosting service. This verifies that your local SSH setup can authenticate.<\/p>\n
              ssh -T git@github.com\n# Or for GitLab: ssh -T git@gitlab.com\n# Or for Bitbucket: ssh -T git@bitbucket.org\n<\/code><\/pre>\n
              You should see a message indicating successful authentication (e.g., "Hi your_username! You've successfully authenticated…"). If you see "Permission denied (publickey)", re-evaluate the previous steps.<\/p>\n
              Use the -v<\/code> flag for verbose output (ssh -vT git@github.com<\/code>) if you're still facing issues. This can provide valuable debugging information about which keys are being tried and why they're failing.<\/p>\n<\/blockquote>\n
              6. Troubleshoot ~\/.ssh\/config<\/code> (Advanced)<\/h4>\n
              If you have a ~\/.ssh\/config<\/code> file, it might be interfering.<\/p>\n
                \n
              1. Inspect ~\/.ssh\/config<\/code>:<\/strong><\/p>\n
                cat ~\/.ssh\/config\n<\/code><\/pre>\n
                Look for Host<\/code> entries related to your Git provider (e.g., Host github.com<\/code>). Ensure any IdentityFile<\/code> directives point to the correct private key and that there are no conflicting options.<\/p>\n
                A minimal working configuration might look like this:<\/p>\n
                Host github.com\n    Hostname ssh.github.com\n    Port 443\n    User git\n    IdentityFile ~\/.ssh\/id_ed25519\n    AddKeysToAgent yes\n    UseKeychain yes # macOS specific, ignore on Ubuntu\n<\/code><\/pre>\n
                The Port 443<\/code> and Hostname ssh.github.com<\/code> lines are useful if you're behind a firewall that blocks standard SSH port 22.<\/p>\n<\/li>\n
              2. Temporarily disable ~\/.ssh\/config<\/code>:<\/strong>\nRename it (mv ~\/.ssh\/config ~\/.ssh\/config_backup<\/code>) and try connecting again. If it works, the issue is in your config file.<\/p>\n<\/li>\n<\/ol>\n
                7. Persist ssh-agent<\/code> Across Sessions (Optional but Recommended)<\/h4>\n
                To avoid re-running eval "$(ssh-agent -s)"<\/code> and ssh-add<\/code> every time you open a new terminal or reboot, configure your shell to handle this automatically.<\/p>\n
                  \n
                1. For Bash users:<\/strong>\nEdit your ~\/.bashrc<\/code> file:<\/p>\n
                  nano ~\/.bashrc\n<\/code><\/pre>\n
                  Add the following lines at the end:<\/p>\n
                  # Start ssh-agent if not running\nif [ -z "$SSH_AUTH_SOCK" ]; then\n    eval "$(ssh-agent -s)"\n    ssh-add ~\/.ssh\/id_ed25519 # Add your private key here\nfi\n<\/code><\/pre>\n
                  Save the file and exit (Ctrl+X<\/code>, Y<\/code>, Enter<\/code>).\nThen, apply the changes: source ~\/.bashrc<\/code>.<\/p>\n<\/li>\n
                2. For Zsh users:<\/strong>\nEdit your ~\/.zshrc<\/code> file:<\/p>\n
                  nano ~\/.zshrc\n<\/code><\/pre>\n
                  Add the same lines as for Bash. Save, exit, and then source ~\/.zshrc<\/code>.<\/p>\n
                  While convenient, ssh-add<\/code> in .bashrc<\/code>\/.zshrc<\/code> will prompt for your passphrase every time a new shell is opened if the agent doesn't already have the key. A more robust solution might involve using keychain<\/code> (if available on Ubuntu) or relying on desktop environment integration. For most server environments where you login via SSH directly, the above if<\/code> block is a practical solution.<\/p>\n<\/blockquote>\n<\/li>\n<\/ol>\n
                  By systematically following these steps, you should be able to resolve the "Permission Denied (publickey)" error caused by SSH key agent issues on your Ubuntu 22.04 LTS system and resume your Git operations.<\/p>\n","protected":false},"excerpt":{"rendered":"
                  Resolve Git ‘Permission Denied (publickey)’ errors on Ubuntu 22.04 LTS by troubleshooting SSH key agent issues, ensuring correct key setup, and proper Git host authentication.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[105],"tags":[40,106,110,112,6,111],"class_list":["post-41","post","type-post","status-publish","format-standard","hentry","category-git-ci-cd","tag-devops","tag-git","tag-ssh","tag-ssh-agent","tag-troubleshooting","tag-ubuntu-22-04"],"_links":{"self":[{"href":"https:\/\/butitworkedlocal.com\/wp-json\/wp\/v2\/posts\/41","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/butitworkedlocal.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/butitworkedlocal.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/butitworkedlocal.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/butitworkedlocal.com\/wp-json\/wp\/v2\/comments?post=41"}],"version-history":[{"count":2,"href":"https:\/\/butitworkedlocal.com\/wp-json\/wp\/v2\/posts\/41\/revisions"}],"predecessor-version":[{"id":289,"href":"https:\/\/butitworkedlocal.com\/wp-json\/wp\/v2\/posts\/41\/revisions\/289"}],"wp:attachment":[{"href":"https:\/\/butitworkedlocal.com\/wp-json\/wp\/v2\/media?parent=41"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/butitworkedlocal.com\/wp-json\/wp\/v2\/categories?post=41"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/butitworkedlocal.com\/wp-json\/wp\/v2\/tags?post=41"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}