AnsibleByExample

Fix Ansible "Permission Denied" SSH Error — 5 Solutions That Work

beginnerAnsible ErrorSSHAnsible TroubleshootingPermission Denied
2026-03-032By Luca Berton

Lesson 1 of 20 in Production Playbooks

Production Playbooks and Troubleshooting — full curriculum
  1. 1. Advanced Playbook Structure & Execution Strategies
  2. 2. Deep Dive: Variable Precedence & Best Practices
  3. 3. Jinja2 Templating Beyond Basics
  4. 4. Advanced Conditionals
  5. 5. Loops Masterclass
  6. 6. Blocks, Rescue, Always (Error Handling)
  7. 7. Handlers Advanced
  8. 8. Change Control: changed_when, failed_when
  9. 9. Tags and Selective Runs
  10. 10. Performance Tuning
  11. 11. Delegation Patterns
  12. 12. Local Actions and Remote Actions
  13. 13. Dynamic Inventory & Runtime Host Management
  14. 14. Includes & Imports (Structuring Large Codebases)
  15. 15. Role Design Patterns
  16. 16. Ansible Galaxy & Collections in Real Projects
  17. 17. Working with APIs (uri + JSON workflows)
  18. 18. Testing and Linting (Quality Gates)
  19. 19. Advanced Debugging Playbook Failures
  20. 20. Capstone: Multi-Stage Deployment
View path overview →

The "Permission denied" SSH error is one of the most common Ansible issues. Here are the 5 most effective solutions.

The Error

fatal: [webserver]: UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: Permission denied (publickey,password).",
    "unreachable": true
}

Solution 1: Check SSH Key Configuration

The most common cause is a missing or incorrect SSH key.

# ansible.cfg
[defaults]
private_key_file = ~/.ssh/id_ed25519
remote_user = deploy

Test SSH connectivity first:

ssh -i ~/.ssh/id_ed25519 deploy@webserver -v

Solution 2: Fix SSH Key Permissions

SSH refuses keys with incorrect permissions.

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub
chmod 644 ~/.ssh/authorized_keys

Solution 3: Use ansible_ssh_private_key_file

Set the key per host in your inventory:

[webservers]
webserver ansible_host=192.168.1.10 ansible_user=deploy ansible_ssh_private_key_file=~/.ssh/deploy_key

Solution 4: Fix become (sudo) Permission Denied

If SSH works but tasks fail with permission denied, it's a become issue:

- name: Install package (requires sudo)
  ansible.builtin.apt:
    name: nginx
    state: present
  become: true
  become_method: sudo
  become_user: root

Run with --ask-become-pass if sudo requires a password:

ansible-playbook playbook.yml --ask-become-pass

Solution 5: Add Host to known_hosts

First connection to a new host may fail if host key checking is strict:

# ansible.cfg
[defaults]
host_key_checking = False

Or add the host key first:

ssh-keyscan webserver >> ~/.ssh/known_hosts

Quick Diagnostic Checklist

# 1. Test SSH directly
ssh -vvv user@host

# 2. Test with Ansible verbose
ansible webserver -m ping -vvvv

# 3. Check key permissions
ls -la ~/.ssh/

# 4. Check remote authorized_keys
ssh user@host "cat ~/.ssh/authorized_keys"

Conclusion

SSH Permission Denied errors in Ansible almost always come down to key configuration, file permissions, or become privileges. Start with the SSH connection test and work your way through each solution.

All Tutorials