david@sshd: Permission denied (publickey,password). means the SSH server was reached, refused the key the client offered, and the client had no more methods to try. In this test the user david on the server had no authorized_keys entry for it. Adding the client's public key to that user's ~/.ssh/authorized_keys on the server fixed it.

The words in brackets are the methods the server allows. Your key is checked against the account named before the @, so the key has to be listed for that user, not for another account on the same server.

The error

$ ssh -o BatchMode=yes david@sshd hostname
david@sshd: Permission denied (publickey,password).
exit=255

Why it happens

The same client key had logged in as the user dev, whose authorized_keys held it, on the first server container of this test (the one in the 0644 post); david was created on the second one. The user david had just been created and had no .ssh folder at all. With -v, the client showed it offered the key, that the server did not accept it, and that nothing was left to try (output filtered with grep, as the command shows): 

$ ssh -v -o BatchMode=yes david@sshd hostname 2>&1 | grep -E 'Authentications that can continue|Offering public key|Server accepts|Permission denied|No more authentication'
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: /root/.ssh/id_ed25519 ED25519 SHA256:Fh6P40lH0goG5+3IeGniCZwZL2guzd3rBM7wcAAG+w8
debug1: Authentications that can continue: publickey,password
debug1: No more authentication methods to try.
david@sshd: Permission denied (publickey,password).

With BatchMode=yes the client asked for no password, the way a script or CI job runs. A second cause printed the same last line in this test: a private key with mode 644 (see the linked post below). Without -v, that case printed the UNPROTECTED PRIVATE KEY FILE banner and Load key "/root/.ssh/id_ed25519": bad permissions above the same last line, while the run for david printed the last line alone.

The fix

On the server, as root, give the user a .ssh folder and the client's public key:

$ install -d -m 700 -o david -g david /home/david/.ssh
exit=0
$ cp /root/client.pub /home/david/.ssh/authorized_keys; chown david:david /home/david/.ssh/authorized_keys; chmod 600 /home/david/.ssh/authorized_keys
exit=0
$ ls -la /home/david/.ssh
total 12
drwx------ 2 david david 4096 Nov 13 05:30 .
drwxr-x--- 3 david david 4096 Nov 13 05:30 ..
-rw------- 1 david david   92 Nov 13 05:30 authorized_keys
exit=0

Then, from the client, the same login worked:

$ ssh -o BatchMode=yes david@sshd whoami
david
exit=0

client.pub is the client's id_ed25519.pub, copied to the server container for this test; the line in authorized_keys matched the client's .pub file. Only the public half ever goes to the server. The folder and file were owned by the user with modes 700 and 600, the same as for the working dev account; other modes were not tested here.

How it was reproduced

Reproduced inside ubuntu:24.04 containers on one user-defined Docker network on Docker engine 29.9.3, with OpenSSH_9.6p1 Ubuntu-3ubuntu13.20 as client and server (apt packages openssh-client and openssh-server). The client's Ed25519 key was made in its container with ssh-keygen; the server had a working user dev and a new user david made with useradd -m. The containers were removed afterwards.

Frequently asked

What does Permission denied (publickey,password) mean in SSH?
The server was reached and refused the key the client offered, and the client had no more methods to try. In this test the key was not in the target user's authorized_keys.
How do I fix Permission denied (publickey,password)?
Add the client's public key to ~/.ssh/authorized_keys of the user you log in as on the server, with the folder at mode 700 and the file at 600, owned by that user. The login worked right after.
How do I see which SSH key is being offered?
Run ssh with -v. The line Offering public key names the key file and its fingerprint.

For the key that is ignored because of its file mode, see SSH: Permissions 0644 are too open; for GitHub's version of this message, see Permission denied (publickey). More decoded errors in the Fixes category.