Troubleshooting SSH

Start with verbose output

ssh -vvv workshop-db

Three vs show handshake details: which keys offered, KEX algorithms, auth success/failure. Read from the bottom up for the first fatal error.

Common failures and fixes

Symptom	Likely cause	Fix
Connection refused	sshd down or wrong port	systemctl status ssh on server; check Port in config
Connection timed out	Firewall, wrong IP, host offline	ping/traceroute; verify router forward; Proxmox console
Permission denied (publickey)	Key not in authorized_keys, wrong user	Check ~/.ssh/authorized_keys, file perms, AllowUsers
Too many authentication failures	SSH offering too many keys	IdentitiesOnly yes + correct IdentityFile
Host key verification failed	Server rebuilt, IP reused	Remove old line from ~/.ssh/known_hosts after verifying legitimate change
Bad owner or permissions	Loose perms on ~/.ssh	chmod 700 ~/.ssh; chmod 600 authorized_keys

Worked example — Saturday morning outage

Marcus cannot reach workshop-web before class. His checklist:

Root cause example: VM disk full → sshd cannot write logs → auth weirdness. Fix: expand disk, journalctl --vacuum-size=200M, restart ssh.

Server-side log locations

# Debian/Ubuntu
sudo journalctl -u ssh -f
sudo tail -f /var/log/auth.log

# Check who is listening
sudo ss -tlnp | grep :22

Client-side checks

# Confirm key loaded
ssh-add -l

# Test specific key
ssh -i ~/.ssh/workshopco_ed25519 -vvv deploy@10.20.0.10

# Compare host key fingerprint (out-of-band verify)
ssh-keyscan bastion.workshopco.ca