iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
“Access denied” in PuTTY or WinSCP means the SSH service was reached, but every authentication method the client tried was rejected. The cause may be a wrong VPS username, a password-disabled image, an incorrectly selected or formatted private key, an unintended Pageant or ssh-agent key, a server-side authorized_keys problem, or an account policy. It is not automatically a PuTTY or WinSCP defect.
Work through the checks in order: classify the error, verify host/port/protocol/user, use the VPS provider’s console to inspect the server, then test one credential or policy change at a time. This separates network problems from login failures and gives you a recoverable path when remote SSH access is unavailable.
Recommended Free Tools
What “Access denied” actually tells you
PuTTY’s manual describes the message as meaning that PuTTY has run out of ways to authenticate you to an SSH server. WinSCP can display similar wording such as “Authentication refused,” “Server refused our key,” or “Too many authentication failures.” In each case, the TCP connection and SSH negotiation got far enough for the server to evaluate login methods. The message itself does not identify whether the rejected item was the username, password, key, account policy, or client configuration.
That distinction matters. A timeout, a refused TCP connection, or a failure before the SSH banner points first to a server outage, wrong port, proxy, protocol selection, or firewall. Changing passwords or converting keys will not repair a blocked port. Conversely, repeatedly changing firewall rules will not fix a key that is in the wrong account’s authorized_keys file.
Classify the symptom before changing anything
| What you see | What it usually means | First check |
|---|---|---|
| Access denied, Authentication refused, or Server refused our key | SSH reached the service, but authentication methods were rejected. | Username, permitted methods, selected key, server logs, and account policy. |
| Too many authentication failures | The client offered several keys, commonly through Pageant or ssh-agent, and the server stopped accepting attempts before the intended key was tried. | Disable agent use temporarily or load only the key for this VPS. |
| Connection timed out | The host/port is unreachable or traffic is being filtered. | VPS status, SSH port, provider firewall, local firewall, proxy, and network route. |
| Connection refused | The address was reachable, but no service accepted the connection on that port, or a firewall actively rejected it. | SSH service status and the configured port on the VPS. |
| Protocol or SFTP/FTP error | The client is using the wrong file-transfer protocol or an unsupported service. | Select SSH/SFTP for an SSH server; do not choose FTP or FTPS. |
If one client reaches an “Access denied” screen while another cannot connect at all, solve the transport problem first for the failing client. If both reach authentication and both are denied, investigate the shared server policy or credentials.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Verify the PuTTY or WinSCP session fields
A surprising number of login failures are caused by a single field copied from the wrong place. Check these values before editing the server.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Host name or IP: Use the VPS address assigned by the provider. Confirm that a DNS name resolves to the current machine and that you are not using an old address after a rebuild.
- Protocol: In PuTTY select SSH. In WinSCP select SFTP or SCP over SSH, not FTP or FTPS. SFTP and SCP still depend on the SSH daemon’s authentication rules.
- Port: SSH uses port 22 by default, but a provider image or administrator may have changed it. Enter the actual SSH port shown in the VPS documentation or server configuration.
- Username: Use the operating-system account created by the VPS image. Typical images create a distribution-specific non-root user; the control-panel login, billing email, and local Windows username are not substitutes.
- Proxy and tunnel settings: If a proxy, jump host, or SSH tunnel is configured, temporarily remove it or verify it independently. A proxy omission can look like a server refusal in WinSCP.
Save a session only after these fields are confirmed. A saved profile can preserve an obsolete port or username and make every subsequent test fail in exactly the same way.
Use the VPS provider console to separate reachability from authentication
Most VPS services offer a browser-based, serial, or virtual console. It connects to the machine without relying on your remote SSH credentials, so it is the safest recovery route when PuTTY and WinSCP are both denied.
Confirm that the SSH service is running
On Debian- and Ubuntu-family systems the service is commonly named ssh; on many RHEL-family systems it is commonly sshd. Use the service name documented for your distribution, for example systemctl status ssh or systemctl status sshd. If it is stopped, inspect the reason before restarting it. A syntax error in the daemon configuration can prevent a restart and may require reverting the last change.
Read the authentication log
Use the distribution’s journal or authentication log from the console. Common locations include the system journal and files such as /var/log/auth.log or /var/log/secure; names vary by distribution and logging setup. Look at the timestamp matching your failed attempt. Messages such as “invalid user,” “bad ownership or modes,” “user not allowed,” “account locked,” or “publickey denied” identify a different fix than a generic client message.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Check the effective SSH configuration
Inspect the daemon configuration and any included drop-in files for rules affecting this account. Pay particular attention to PasswordAuthentication, PubkeyAuthentication, PermitRootLogin, AllowUsers, and DenyUsers. A provider image may intentionally disable root or password login even when the account has a valid password. Do not enable a weaker method permanently just to make one test pass; restore the intended policy after recovery.
When password authentication is being rejected
Use the VPS account password, not a control-panel password
The password for the provider’s web dashboard and the password for a Linux account are separate credentials. Enter the password assigned to the operating-system user. If you reset it in the console, make the change on the correct account and record the exact username used in PuTTY or WinSCP.
Rule out local typing errors
- Check Caps Lock and the keyboard layout. A password containing symbols can be transformed when your local layout differs from the layout used when it was created.
- Type the password into a local, visible field first if you need to verify characters, then paste it into the SSH prompt. SSH password prompts normally show no characters or dots; that behavior is expected.
- Remove trailing spaces introduced when copying a password from a password manager or document.
Determine whether the image allows passwords at all
Many hardened VPS images are key-only and set PasswordAuthentication no. In that case, a perfectly correct password is rejected because the server does not offer password authentication. The console and authentication log will show the effective policy. Use the installed public key or another permitted recovery account instead of repeatedly changing the password.
Check account state
An expired password, locked account, expired account date, or invalid login shell can block password login. From the console, use the account-management tools appropriate to your distribution to inspect status and expiration. Unlock or reset the account only after confirming that doing so complies with your security policy.
When public-key authentication is being rejected
Select the private key in the correct client location
In PuTTY, open Connection > SSH > Auth and select the private-key file for the session. In WinSCP, open the site’s Advanced Site Settings > SSH > Authentication page and set the private-key file there. Confirm that the selected key belongs to this VPS and to the username being used; selecting a key for another server produces the same visible denial.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Understand PPK and OpenSSH formats
PuTTY commonly uses its PPK private-key format. WinSCP expects a PuTTY-format private key for direct private-key selection, although it can convert OpenSSH or ssh.com keys. Use the conversion option in the key-management dialog, save the resulting PPK securely, and then select that file in WinSCP or PuTTY. Never paste a private key into authorized_keys; the server receives the matching public key line only.
Control Pageant and ssh-agent
WinSCP’s authentication order can include GSSAPI, a public key offered by Pageant, a configured private key, keyboard-interactive authentication, and password authentication. PuTTY can likewise use Pageant. If an agent contains many identities, the server may count each offered key and terminate the session with “Too many authentication failures” before the correct key is attempted.
- Temporarily disable the option that uses an authentication agent in the client’s SSH authentication settings, then retry with only the explicitly selected private key.
- Alternatively, close the agent or remove unrelated identities and load only the key for this VPS.
- After a successful login, re-enable agent use selectively and keep the number of loaded keys small.
Keyboard-interactive authentication can also be enabled or disabled in WinSCP’s Authentication settings. If the server expects a second factor or an interactive challenge, disabling that method will prevent login even when the key is correct.
Repair the server-side key installation
The public key must be installed for the exact account named in the client. From the provider console or an already authorized administrative session, inspect that user’s home directory and the .ssh/authorized_keys file.
- Confirm that the home directory belongs to the intended login account and that the
.sshdirectory exists beneath it. - Check that the complete public-key line is present in
.ssh/authorized_keys. A wrapped line, missing prefix, or accidental line break makes the key unusable. - Verify ownership of the home directory,
.ssh, andauthorized_keys. They should normally be owned by the login account rather than by an unrelated administrator or writable group. - Use restrictive permissions. WinSCP’s public-key guidance specifically recommends mode 600 for
authorized_keys. The parent directory must also not be group- or world-writable; exact modes can vary with the operating system’s security policy. - Check that the client’s private key really corresponds to the public key installed on the server. Converting a key or copying a different public key does not change which private key PuTTY or WinSCP is using.
After correcting the file, retry once and immediately read the server log. If it still reports bad ownership, follow the exact path named in the log; a restrictive policy can reject a key because of a writable parent directory several levels above .ssh.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Check account and server policy beyond the key file
A valid key can still be denied by policy. Check the following from the console:
- Root login: Many images disable direct root SSH login. Use the image’s regular administrative user and elevate privileges after login, or follow the provider’s documented root-recovery procedure.
- Allow and deny lists:
AllowUsers,DenyUsers, group restrictions, and included configuration files can exclude an otherwise valid account. - Login shell: An account assigned a non-login shell, a missing shell binary, or a shell restricted by policy cannot start an SSH session normally.
- Account lock and expiry: Password aging, an account expiration date, or an administrative lock can affect password and sometimes key-based access depending on the system.
- Mandatory access controls: SELinux, AppArmor, or a provider hardening layer may deny access after a file move or permission change. Use the security audit messages to identify this case rather than disabling the control blindly.
Make one policy change at a time, preserve a second console session, and test before closing the working session. A broad edit to SSH configuration can lock out every account at once.
When the problem really is a port, proxy, or firewall
Investigate network controls when the symptom is a timeout or connection refusal, or when one client connects while another cannot reach the SSH banner.
Server-side checks
- Confirm the VPS is powered on and has not been paused, rebuilt, or assigned a new address.
- Verify which port the SSH daemon listens on and that the provider’s cloud firewall permits inbound TCP traffic to that port from your source address.
- Check the operating-system firewall rules. A rule allowing port 22 does not help if SSH was moved to another port.
Client-side checks
Local endpoint-security software can block a newly upgraded executable even when an exception exists for an older version. WinSCP documentation notes this per-application behavior. Check the local firewall or security suite for a rule covering the current PuTTY or WinSCP executable, and test from a trusted network if a corporate proxy or egress filter may be involved. Do not permanently disable endpoint protection; create a narrowly scoped rule or obtain the network administrator’s approval.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Retest with a controlled one-variable method
Once the obvious configuration is correct, avoid changing several settings at once. Keep the host, port, protocol, username, and selected key fixed. Change only the suspected variable, perform one login attempt, and record the server-log message.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Start with the provider console open so you cannot lose your recovery path.
- Test the intended username with the intended key and agent disabled.
- If denied, test the same session with the server’s documented alternate method, such as password or keyboard-interactive, only if that method is permitted.
- Read the matching log entry and classify it as key mismatch, account restriction, bad permissions, lockout, or transport failure.
- Apply the smallest correction, then repeat the same test. Keep a written record of the original and corrected values.
This process prevents a common trap: changing the port, username, key, and firewall simultaneously, then having no way to know which change fixed the problem or which one weakened the server.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Password login versus public-key login
| Factor | Password | Public key |
|---|---|---|
| VPS image support | May be disabled by hardened images through the SSH daemon policy. | Usually enabled when a provider injects a key during deployment, but the matching public key must be installed for the account. |
| Recovery when access is lost | A console password reset can restore access if password authentication is enabled. | Use the console or another administrator to install the correct public key; losing the private key requires replacing the key pair. |
| Client complexity | Requires correct typing, keyboard layout, and account password. | Requires the matching private key, compatible format, correct file permissions, and sometimes agent management. |
| Auditability | Accounts share fewer visible artifacts, but password use is harder to attribute when credentials are shared. | Separate key pairs can identify people or systems and can be revoked by removing one public-key line. |
| Brute-force exposure | Exposed password authentication attracts password-guessing attempts and should be protected with strong policy and rate controls. | Cryptographic keys avoid password guessing, provided the private key is protected and the server rejects unauthorized keys. |
Choose the method required by the image and your organization’s policy. Enabling password login solely because a key is inconvenient can expand the attack surface and may conflict with the provider’s hardening guidance.
PuTTY versus WinSCP for this problem
| Client | Best suited to | Relevant authentication controls |
|---|---|---|
| PuTTY | Interactive terminal administration and command-line work. | SSH session fields, private key under Connection > SSH > Auth, and optional Pageant integration. |
| WinSCP | SFTP or SCP file transfer with an optional terminal. | SFTP/SCP protocol selection, private key under Advanced Site Settings > SSH > Authentication, agent use, keyboard-interactive authentication, and password fallback. |
Both clients ultimately ask the same SSH server to authenticate the same account. Switching from PuTTY to WinSCP can reveal a client-side format or agent setting, but it cannot bypass a server-side AllowUsers rule, a disabled authentication method, or an incorrectly installed public key.
Common scenarios and the shortest safe fix
“The password is definitely correct, but it is still denied.”
Verify that the password belongs to the operating-system account, then check whether the image disables password authentication. If it is key-only, use the injected key or console recovery; changing the password will not alter the SSH policy.
“WinSCP says the server refused my key.”
Confirm the username, select the matching private key in the Authentication page, convert it to PPK if WinSCP requires that format, and inspect the target account’s authorized_keys, ownership, and permissions. Read the server log before replacing the key.
“PuTTY works from the VPS console, but not from my computer.”
The console proves the account and daemon can work locally, not that your external route is open. Verify the public IP, SSH port, provider firewall, local firewall, proxy, and protocol. If the remote client reaches authentication and is denied, return to the username and key checks.
“It worked until I upgraded WinSCP or PuTTY.”
Check whether the upgraded executable lost its local firewall exception or whether the saved session now points to a different key or agent. Restore a narrowly scoped firewall rule and compare the saved session fields with a known-good profile.
“I get too many authentication failures even though the right key is loaded.”
Disable Pageant or ssh-agent for the session, remove unrelated identities, and offer only the intended key. This lets the server see the correct key before its authentication-attempt limit is reached.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Final recovery checklist
- The host resolves to the current VPS address.
- SSH/SFTP is selected instead of FTP/FTPS.
- The provider’s actual SSH port is entered.
- The username is the VPS operating-system account.
- The VPS is running and the SSH service is listening.
- The server policy allows the authentication method you are testing.
- The selected private key matches the public key in the correct user’s
authorized_keys. - The key format is accepted by the client, and unrelated agent keys are not being offered.
- The account is not locked, expired, denied by an allow/deny rule, or assigned an invalid shell.
- The key file and parent directories have safe ownership and permissions, including mode 600 for
authorized_keyswhere applicable. - Provider and operating-system firewalls allow the configured port, and local security software permits the current client executable.
- The exact server-log reason has been recorded before making another change.
The Bottom Line
PuTTY or WinSCP “Access denied” is an SSH authentication failure, not a diagnosis. Verify the session fields, use the VPS console and logs, select the correct key or permitted password method, control agent identities, repair authorized_keys permissions, and only then investigate firewalls or ports.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
