# SSH: Permission Denied after clone of template - Permission denied (publickey,gssapi-keyex,gssapi-with-mic) **URL:** \ **Category:** Rocky Linux Help & Support\ **Tags:** rocky-linux-9\ **Created:** [May 15, 2024, 6:13pm UTC](https://forums.rockylinux.org/t/ssh-permission-denied-after-clone-of-template-permission-denied-publickey-gssapi-keyex-gssapi-with-mic/14095 "2024-05-15T18:13:28Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![echum1310](https://avatars.discourse-cdn.com/v4/letter/e/7ea924/32.png) [@echum1310](https://forums.rockylinux.org/u/echum1310)\ **Post date:** [May 15, 2024, 6:13pm UTC](https://forums.rockylinux.org/t/ssh-permission-denied-after-clone-of-template-permission-denied-publickey-gssapi-keyex-gssapi-with-mic/14095/1 "2024-05-15T18:13:28Z")
Hey everyone! I’m having an issue where, after I clone a template in Proxmox of Rocky v9.4 VM, I can no longer SSH into the machine using a password. I could before I turned it into a template, but I suspect I messed something up by turning it into a template. Here’s some extra information because the VM had been customized before turning it into a Proxmox template: **Background** **OS:** RockyLinux 9.4 with the CIS Benchmark Server 1 security policy enabled (this also means the partitions are slightly different than default) **Installed & Configured:** Fail2Ban, firewalld, cloud-init **What I’ve tried** - Every combination of `/etc/ssh/sshd_config` that I can think of - Disabling fail2ban & firewalld, but neither of them were putting anything in their logs about blocking my IP since my subnet is set within fail2ban’s `ignoreip` setting - Making sure that my user had 700-level permissions on /root/.ssh & /home/user1/.ssh - SSHing from a separate machine on the same trusted subnet **SSH -v Output from workstation (more available upon request)** ```auto Authorized uses only. All activity may be monitored and reported. debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic debug1: Next authentication method: publickey debug1: get_agent_identities: agent returned 2 keys debug1: Will attempt key: /Users/user1/.ssh/id_rsa debug1: Will attempt key: /Users/user1/.ssh/id_ecdsa debug1: Will attempt key: /Users/user1/.ssh/id_ecdsa_sk debug1: Will attempt key: /Users/user1/.ssh/id_ed25519 ED25519 SHA256: ~publickey~ debug1: Will attempt key: /Users/user1/.ssh/id_ed25519_sk debug1: Will attempt key: /Users/user1/.ssh/id_xmss debug1: Will attempt key: /Users/user1/.ssh/id_dsa debug1: Trying private key: /Users/user1/.ssh/id_rsa debug1: Trying private key: /Users/user1/.ssh/id_ecdsa debug1: Trying private key: /Users/user1/.ssh/id_ecdsa_sk debug1: Offering public key: /Users/user1/.ssh/id_ed25519 ED25519 SHA256: ~publickey~ debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic debug1: Trying private key: /Users/user1/.ssh/id_ed25519_sk debug1: Trying private key: /Users/user1/.ssh/id_xmss debug1: Trying private key: /Users/user1/.ssh/id_dsa debug1: No more authentication methods to try. user1@xxx.xxx.xxx.xxx: Permission denied (publickey,gssapi-keyex,gssapi-with-mic). ``` **Something to note:** I did what I do for my Ubuntu templates where I delete all SSH hostkeys, remove the machine-id, apt/dnf clean, autoremove, and cloud-init clean. This doesn’t happen with the Ubuntu templates, but I’ve also never used the CIS Server 1 policies so it could be that causing issues. ---
**Author:** ![james-p](https://avatars.discourse-cdn.com/v4/letter/j/b782af/32.png) [@james-p](https://forums.rockylinux.org/u/james-p)\ **Post date:** [May 16, 2024, 2:34pm UTC](https://forums.rockylinux.org/t/ssh-permission-denied-after-clone-of-template-permission-denied-publickey-gssapi-keyex-gssapi-with-mic/14095/2 "2024-05-16T14:34:41Z")
Looks like you have ‘PasswordAuthentication’ set to ‘no’ ? There are extra sshd config settings in `/etc/ssh/sshd_config.d/` - is there anything in there that could be causing this issue ? ---
**Author:** ![echum1310](https://avatars.discourse-cdn.com/v4/letter/e/7ea924/32.png) [@echum1310](https://forums.rockylinux.org/u/echum1310)\ **Post date:** [May 20, 2024, 6:02pm UTC](https://forums.rockylinux.org/t/ssh-permission-denied-after-clone-of-template-permission-denied-publickey-gssapi-keyex-gssapi-with-mic/14095/3 "2024-05-20T18:02:48Z")
James, Sorry for the late reply, I’ve been out of town. You were actually spot on! The file `50-cloud-init.conf` within `/etc/ssh/sshd_config.d` has one single line that disabled password authentication. It seems like I have much to learn about cloud-init still. Thanks for the help! ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\ **Post date:** [July 19, 2024, 6:03pm UTC](https://forums.rockylinux.org/t/ssh-permission-denied-after-clone-of-template-permission-denied-publickey-gssapi-keyex-gssapi-with-mic/14095/4 "2024-07-19T18:03:37Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.