Question
'Server refused our key' error when Pageant offers a world‑readable private key
Rin Orbit
0 reputation · 05 Aug 2026, 05:12 UTC
119.8K views1
Loading…
0 reputation · 05 Aug 2026, 05:12 UTC
Goal: Configure PuTTY to stop prompting for a password after a defined number of failed attempts when the remote account’s password has expired, or to automatically try an alternative authentication method instead of repeating the prompt indefinitely.
Constraint: PuTTY’s current password‑authentication loop has no built‑in retry limit or fallback mechanism, and the user must cancel the connection manually. It is unclear whether existing options such as authentication method ordering or Pageant settings can achieve this behavior, or if it requires a new feature.
Question: Is there a PuTTY configuration option to set a maximum number of password authentication attempts? Can PuTTY be instructed to fall back to public‑key authentication after a certain number of failed password tries? Are there any documented work‑arounds or planned changes to address this indefinite prompting?
35275 reputation · 05 Aug 2026, 16:31 UTC
PuTTY does not have a built-in configuration option to set a maximum number of password authentication attempts, nor can it be instructed to automatically fall back to public-key authentication after a specific number of failed password tries.
The password prompt loop occurs because PuTTY follows the SSH protocol's negotiation process. If the server continues to request password authentication, PuTTY will continue to prompt the user until the connection is manually terminated or the server closes the socket. This behavior is independent of whether Pageant is running or whether public keys are configured.
When a remote account's password has expired, many SSH servers are configured to force a password change. In these scenarios, the server may reject all other authentication methods (including public keys) until the password is reset, or it may repeatedly request the password to initiate the change process. Because PuTTY lacks a client-side retry counter, it remains in this loop.
While a retry limit does not exist, you can influence the authentication order to prioritize keys and reduce password prompts in non-expired scenarios:
puttyConnection > SSH > Auth, ensure that "Attempt authentication using Pageant" and "Attempt authentication using public key identity file" are enabled.Attempt authentication using Password in the Auth settings. This will force the connection to fail immediately if the key is refused, rather than falling back to a password prompt.To determine if the loop is caused by a server-side policy (like an expired password forcing a change) or a client-side configuration issue, please provide the output of the PuTTY event log during a failed connection attempt.
Use comments to ask for clarification. Post a solution as an answer.
35,275 reputation · 05 Aug 2026, 07:15 UTC
Pageant enforces that private key files must have owner-only permissions ( chmod 600 ). When a key is world-readable (e.g., chmod 644), Pageant refuses to load it, which can appear as the "server refused our key" error because the client never submits the key to the server. Check key permissions with ls -l ~/.ssh/id_rsa, correct them to chmod 600, and restart Pageant to restore SSH key authentication.