Troubleshooting “Permission Denied (publickey)” SCP Error When SSH Works: EC2 Key File Path Resolution


6 views

The error message reveals a critical path resolution problem in your SCP command:

Warning: Identity file /Desktop/Blocks/blocks_key.pem not accessible: No such file or directory.
Permission denied (publickey)

Notice how the debug output shows /Desktop/Blocks/ (absolute path) while your command specifies ~/Desktop/Blocks/ (relative path). This path discrepancy is the root cause.

While both SSH and SCP use the same authentication mechanism, they handle path expansion differently:

  • SSH properly resolves ~ to your home directory
  • SCP in some versions has issues with tilde expansion in the -i parameter

Solution 1: Use Absolute Paths

scp -i /home/yourusername/Desktop/Blocks/blocks_key.pem \
~/Desktop/Blocks/code/www/uploadtest.html \
ubuntu@ip.address:/var/www

Solution 2: Environment Variable Approach

export KEY_PATH=~/Desktop/Blocks/blocks_key.pem
scp -i $KEY_PATH ~/Desktop/Blocks/code/www/uploadtest.html ubuntu@ip.address:/var/www

Solution 3: SSH Config File Method

Create or modify ~/.ssh/config:

Host ec2-instance
    HostName ip.address
    User ubuntu
    IdentityFile ~/Desktop/Blocks/blocks_key.pem

Then simply use:

scp ~/Desktop/Blocks/code/www/uploadtest.html ec2-instance:/var/www

For deeper investigation, add verbose flags:

scp -vvv -i ~/Desktop/Blocks/blocks_key.pem \
~/Desktop/Blocks/code/www/uploadtest.html \
ubuntu@ip.address:/var/www

Check key file permissions (essential for EC2):

chmod 400 ~/Desktop/Blocks/blocks_key.pem

Amazon EC2 instances often require strict permission settings:

  • Private key files must have 400 permissions
  • The ubuntu user must have write permissions on /var/www
  • Some AMIs disable password authentication completely

Verify target directory permissions:

ssh -i ~/Desktop/Blocks/blocks_key.pem ubuntu@ip.address \
"ls -ld /var/www"

The error occurs when attempting to use SCP with the same private key that works perfectly for SSH authentication. The debug output shows the system failing to locate and use the specified identity file:

Warning: Identity file /Desktop/Blocks/blocks_key.pem not accessible: No such file or directory.
Permission denied (publickey).
lost connection

While SSH and SCP use the same authentication protocol, their environment handling differs in subtle ways:

  • SCP might inherit different environment variables than your interactive shell
  • File permission requirements are strictly enforced
  • The path resolution might vary depending on how the command is invoked

1. Incorrect File Path Specification

The error shows the system looking for /Desktop/Blocks/blocks_key.pem instead of ~/Desktop/Blocks/blocks_key.pem. Try these alternatives:

scp -i $HOME/Desktop/Blocks/blocks_key.pem ...
scp -i ~/Desktop/Blocks/blocks_key.pem ...
scp -i /home/username/Desktop/Blocks/blocks_key.pem ...

2. File Permission Issues

Ensure the private key has strict permissions:

chmod 600 ~/Desktop/Blocks/blocks_key.pem

3. Environment Variable Differences

SCP might not have the same environment as your shell. Test with:

env -i scp -v -i ~/Desktop/Blocks/blocks_key.pem ...

Increase verbosity to identify the exact point of failure:

scp -vvv -i ~/Desktop/Blocks/blocks_key.pem ...

Check if the key is being offered to the server:

ssh-add -l

If direct SCP fails, consider these workarounds:

# Copy via SSH session
cat localfile | ssh -i key.pem user@host "cat > remotefile"

# Use rsync instead
rsync -avz -e "ssh -i key.pem" localfile user@host:remotefile

Verify these settings in /etc/ssh/sshd_config on the EC2 instance:

PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication no