Troubleshooting guide
Can't connect over SSH? Find the cause, step by step
Refused, timed out, permission denied, or a host key warning.
What does ssh say?
Run it with -v to see more: ssh -v user@host. The last lines say where it stops.
Likely cause
The server doesn't accept your key
The server tried every way you can log in, and none worked: your key isn't in the right authorized_keys, the permissions on ~/.ssh are too open, or you're using the wrong user. The server's auth log says which.
Check it
ssh -v deploy@server 2>&1 | grep -E "Offering|Authentications that can continue"Not this?Start over
Likely cause
Your client offers too many keys
Your SSH agent tries every key it holds, and the server cuts you off before the right one comes up. Offer only the right key, with IdentitiesOnly.
Check it
ssh -v deploy@server 2>&1 | grep OfferingNot this?Start over
Likely cause
The server's key isn't the one you saved
Often innocent: the server was reinstalled, or the address now points to another machine. Check that before you delete the old key, because it can also mean someone is in between.
Read the fix: SSH "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!": check it, then fix known_hostsNot this?Start over
Likely cause
Nothing listens for SSH on that port
The server answered "no" at once: sshd isn't running, listens on another port, or a firewall rejects the connection. Check on the server, from its console.
Check it
sudo systemctl status ssh --no-pager # sshd on RHEL
sudo ss -tlnp | grep sshdNot this?Start over
Likely cause
A firewall drops the connection
Nothing answered at all: a firewall on the server, a cloud security group, or a network in between drops the packets to port 22.
Check it
nc -vz -w 5 server 22Not this?Start over
Likely cause
The server, or the way to it, rejects you
Despite its name, "No route to host" is usually a firewall on the other machine that rejects the connection, or a machine that is down or on another network.
Read the fix: "No route to host": usually a firewall saying no, sometimes a machine that isn't thereNot this?Start over
Likely cause
Your machine can't look up the server's name
DNS on your side fails or doesn't know the name. Try the IP address directly; if that works, it's DNS.
Check it
getent hosts server.example.comNot this?Start over
Have an exact error message? Paste it into search instead.
Every cause this guide covers
The same answers, all on one page, if you would rather scan them.
- The server doesn't accept your keySSH "Permission denied (publickey)": how to find the real cause
- Your client offers too many keysSSH "Too many authentication failures": your agent offers too many keys
- The server's key isn't the one you savedSSH "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!": check it, then fix known_hosts
- Nothing listens for SSH on that port"Connection timed out" vs "Connection refused": what each one tells you, and how to fix it
- A firewall drops the connection"Connection timed out" vs "Connection refused": what each one tells you, and how to fix it
- The server, or the way to it, rejects you"No route to host": usually a firewall saying no, sometimes a machine that isn't there
- Your machine can't look up the server's name"Temporary failure in name resolution": fix DNS on a Linux server