Start with the exact SSH error, then work from the outside in: destination and port, provider firewall, VPS firewall, sshd, authentication, and finally the login shell. A timeout, a refusal, a key rejection, and an immediate disconnect are different failures, so changing settings at random often makes recovery harder. This guide gives a safe order of operations and a recovery path when normal SSH is already unavailable.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Classify the error before changing anything
Copy the complete command and error message into a note. The wording tells you how far the connection got and which layer to inspect first.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems| Client message or symptom | What it usually means | Start here |
|---|---|---|
Connection timed out |
The client sent a connection attempt, but no response arrived before the timeout. | Verify the address and port, then check provider and VPS firewalls and the network path. |
Connection refused |
The request reached the host, but nothing accepted it on that port (or a firewall actively rejected it). | Confirm the configured SSH port and whether sshd is running and listening. |
Permission denied (publickey) |
The SSH service is reachable, but authentication failed for the supplied user/key combination. | Check the username, private key, server-side public key, and file permissions. |
| Connects, then immediately closes | Authentication or session startup failed, or the daemon crashed or rejected the protocol. | Use verbose output, server logs, shell/account checks, and resource checks. |
Unable to negotiate ... no matching key exchange method found |
The client and server have no mutually enabled cryptographic algorithm. | Compare supported algorithms and correct the server or client configuration. |
DigitalOcean documents the timeout example as ssh: connect to host 203.0.113.0 port 22: Connection timed out, the refusal example as ssh: connect to host 203.0.113.0 port 22: Connection refused, and the negotiation example as Unable to negotiate with 203.0.113.0: no matching key exchange method found. These are example error strings, not independent performance measurements.
Confirm the VPS address, SSH port, and local route
Verify the destination
Check the VPS control panel for the current public IPv4 or IPv6 address. If you use a hostname, resolve it from the same computer that is failing:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
dig +short vps.example.com
# or
nslookup vps.example.comCompare the result with the address shown by your provider. A recreated VPS may receive a new address, and a stale DNS record can send you to a different machine. If you have both address families, test the one you intend to use explicitly:
ssh -4 [email protected]
ssh -6 user@[2001:db8::10]Confirm the configured port
Port 22 is the OpenSSH default, not a guarantee. An administrator may have changed the Port directive in /etc/ssh/sshd_config or in a file included from that configuration. Once you have console access, inspect both the main file and its included directory. Until then, check your deployment notes or provider panel for the assigned port and pass it explicitly:
Recommended Free Tools
ssh -p 2222 [email protected]Do not assume that a custom port is safer by itself. It can reduce automated noise, but firewall rules, monitoring, and recovery instructions must all use the same port.
Test whether your current network permits the port
Corporate, school, hotel, and mobile networks sometimes block outbound ports. A TCP test distinguishes a local egress problem from a server-side problem:
nc -vz 203.0.113.10 22
# Linux alternative when netcat is unavailable
curl -v telnet://203.0.113.10:22On Windows PowerShell, use:
Test-NetConnection 203.0.113.10 -Port 22A failed test from one network is not proof that the VPS is down. Retry from a trusted alternate connection, such as a phone hotspot, while keeping the destination and port unchanged.
Check both firewall layers
Most VPS platforms have a provider-level firewall or security group in addition to a firewall inside the virtual machine. Both must allow the actual SSH port from your intended source address. A rule in only one layer is insufficient.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Provider firewall or security group
In the provider dashboard, open the network or firewall settings attached to the VPS. Confirm:
- The rule is attached to this specific VPS or network interface.
- The protocol is TCP and the destination port matches the value in
sshd_config. - The source is your current public IP address, or a deliberately chosen administrative range.
- An IPv6 rule exists if you are connecting over IPv6; IPv4 rules do not cover IPv6.
- No higher-priority deny rule overrides the allow rule.
If you are locked out, temporarily allow SSH from your own current address rather than opening it to the entire internet. If you must use a broad temporary rule for recovery, remove it as soon as access is restored.
Ubuntu and Debian systems using UFW
From the recovery console or an existing administrative session, inspect UFW before changing it:
sudo ufw status verbose
sudo ufw show addedAllow the named OpenSSH application when it is present:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo ufw allow OpenSSHFor a custom port, specify TCP explicitly:
sudo ufw allow 2222/tcpDo not run sudo ufw enable blindly on a remote server. First add a rule for the port you are using and keep a console session open; otherwise enabling UFW can terminate your only access path.
CentOS, Rocky, AlmaLinux, and similar systems using firewalld
sudo firewall-cmd --state
sudo firewall-cmd --list-all
sudo firewall-cmd --list-servicesFor the standard service, add it permanently and reload:
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reloadFor a custom port:
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reloadCheck the active zone before editing; a rule added to an unused zone will not help the interface carrying your traffic.
Systems using iptables or nftables directly
On older or minimal images, inspect the active ruleset instead of assuming UFW or firewalld is installed:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo iptables -nL --line-numbers
sudo nft list rulesetLook for an allow rule on the real SSH port and for an earlier drop or reject rule. Persist any intentional change using the distribution’s normal firewall-management method; an ad-hoc rule may disappear at reboot.
Use the provider recovery console when SSH is unavailable
A web, serial, or out-of-band console is the safest way to repair a firewall or SSH configuration that has locked you out. Open the VPS’s console from the provider panel, authenticate locally, and take a configuration backup before editing:
sudo cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.backup.$(date +%Y%m%d-%H%M%S)If the console offers a snapshot or disk backup, create one before filesystem repairs or major configuration changes. Record which user, port, and firewall rule you intend to restore so you can verify each item after the change.
If the machine does not boot far enough for a console login, use the provider’s rescue environment or attach the disk to another instance. Mount the filesystem read-write only when necessary, repair the configuration, then unmount cleanly before rebooting.
Verify that sshd is running and listening on the expected port
Check service state
Service names vary by distribution. Ubuntu commonly uses ssh; CentOS-family systems commonly use sshd:
sudo systemctl status ssh
sudo systemctl status sshdUse the name that exists on your system. If it is stopped, inspect the reason before starting it:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo journalctl -u ssh -b --no-pager
sudo journalctl -u sshd -b --no-pagerMessages about a syntax error, missing host key, occupied port, or permission problem identify the next fix. Starting a service with an invalid configuration will fail repeatedly, so validate first.
Validate configuration and included files
sudo sshd -tNo output means the syntax check passed. If it reports a line number, correct that file and run the test again. Read the effective configuration, including included files, rather than relying on the main file alone:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallsudo sshd -T | grep -E '^(port|listenaddress|passwordauthentication|pubkeyauthentication|permitrootlogin) 'On systems with multiple configuration fragments, a later directive may override an earlier one. Confirm the resulting port and listenaddress values.
Confirm the listening socket
sudo ss -ltnp | grep -E ':(22|2222)b'Replace 2222 with your configured port. A listener on 127.0.0.1 accepts only local connections; a public VPS normally needs a listener on the relevant interface or on 0.0.0.0/::. If another process already owns the port, the journal will usually show a bind failure.
After a successful change, restart or reload deliberately:
sudo systemctl reload ssh
# If reload is unsupported or the service is stopped:
sudo systemctl restart sshKeep the recovery console open and test a second SSH session before closing the first one. A reload is preferable when available because it preserves existing sessions while the daemon rereads its configuration.
Fix “Permission denied (publickey)” authentication failures
Use the correct account and private key
The login name is part of the connection. Cloud images often disable direct root login and provide a distribution-specific non-root account. Try the account created during provisioning, not the name of your local computer:
ssh -i ~/.ssh/vps_ed25519 [email protected]Use ssh -G [email protected] to see the options the client will apply, including identity files and port. If an agent has many keys loaded, select one explicitly with -i and, when needed, IdentitiesOnly=yes:
ssh -o IdentitiesOnly=yes -i ~/.ssh/vps_ed25519 [email protected]Verify the server-side public key
Through the console, switch to the target account and inspect ~/.ssh/authorized_keys. The public key corresponding to your private key must appear as one complete line. Generate the public half from a private key when you need to compare fingerprints:
ssh-keygen -y -f ~/.ssh/vps_ed25519Do not paste a private key into the server. If the key is missing or damaged, append the correct public key through the console, preserving the account’s existing keys.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Correct ownership and permissions
OpenSSH can reject keys when the directory or file is writable by other users, or owned by the wrong account:
sudo chown -R user:user /home/user/.ssh
sudo chmod 700 /home/user/.ssh
sudo chmod 600 /home/user/.ssh/authorized_keys
sudo chmod go-w /home/userReplace user and the home path with the actual account. Also check parent-directory permissions and filesystem labels on distributions that enforce them. Review authentication logs while making one test connection:
sudo journalctl -u ssh -f
# On some systems:
sudo tail -f /var/log/auth.log
sudo tail -f /var/log/secureThe log may distinguish an unknown user, an unreadable key file, a disabled authentication method, or a policy rejection. Correct the specific cause instead of enabling every authentication method.
Free tools Windows power users keep installed
One-click scans. No signup required.
Investigate protocol errors, resets, and immediate disconnects
Collect client-side evidence
Run a single diagnostic connection with maximum normal verbosity:
ssh -vvv -o ConnectTimeout=10 [email protected]Read the sequence: DNS resolution, TCP connection, host-key exchange, user authentication, and session/channel creation. Do not publish private key material or sensitive usernames when sharing logs.
Check host keys and daemon startup
A missing host key, a corrupted key file, or a daemon that crashes after accepting the socket can produce a reset or immediate close. The server journal will show startup and key-loading failures. Recreate host keys only from the console and only after confirming that the existing keys are genuinely missing; replacing them causes clients to display a host-identity warning.
Handle algorithm negotiation carefully
The documented message Unable to negotiate with 203.0.113.0: no matching key exchange method found. means the client and server have no common key-exchange method. First update the server and client where possible and inspect their effective algorithm lists. Avoid permanently enabling obsolete algorithms. If a temporary compatibility option is unavoidable for recovery, scope it to the single host in the client configuration, complete the server upgrade, and remove the exception.
Rule out middleboxes
A connection that works from one network but resets from another can involve a proxy, VPN, intrusion-prevention device, or stateful firewall rather than the VPS. Compare ssh -vvv output from two networks and check whether both use the same address family and port.
When authentication succeeds but the shell closes
If you see a welcome message and then an immediate disconnect, the network and key exchange already worked. Focus on account startup and system capacity.
Check the account’s home directory and shell
getent passwd user
sudo ls -ld /home/user
sudo chown user:user /home/userThe final field from getent passwd is the login shell. A shell of /usr/sbin/nologin or /bin/false intentionally prevents an interactive session. Change it only if the account should have shell access:
sudo chsh -s /bin/bash userCheck shell startup files such as ~/.bashrc, ~/.profile, or the equivalent for your shell for commands that exit immediately, reference unavailable mounts, or emit fatal errors. Test a non-interactive command to separate shell startup from terminal allocation:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →ssh [email protected] 'id; pwd; printf "session-okn"'Check disk, memory, and process limits
A full filesystem can prevent creation of a session, temporary files, or log entries. Memory pressure and exhausted process or file-descriptor limits can have the same symptom:
df -h
free -h
uptime
ulimit -n
ps -e --no-headers | wc -lInspect the kernel and service logs for out-of-memory kills, fork failures, or repeated crashes. Free space safely, stop an identified runaway service, or increase the constrained resource through the provider. Do not delete unknown system files merely to make a login work.
Recover safely after a lockout
Keep one known-good path open
Before applying firewall or SSH changes, keep the provider console connected or leave one verified SSH session open. Make one change at a time, validate with sshd -t, and test a new session from a second terminal.
Roll back the last change
If a recent firewall or configuration edit caused the outage, restore the last known-good file or remove only the new rule. Re-run syntax checks and confirm the listener and firewall state before rebooting.
Use rescue mode for deeper damage
When the VPS cannot boot, cannot mount its root filesystem, or has lost network configuration, boot the provider’s rescue environment. Mount the original disk, copy important data to separate storage, and repair the smallest necessary set of files. If filesystem damage is irreversible, prioritize data recovery and redeployment over repeated blind edits.
Know when to escalate
Contact provider support when the virtual network interface, assigned address, hypervisor console, or attached volume is malfunctioning, or when you cannot obtain console access. Give support the VPS identifier, timestamp, exact error, tested address and port, and the changes already made. This avoids repeated destructive troubleshooting.
A preventive SSH checklist
- Keep a documented primary user, public IP or hostname, SSH port, and emergency console path.
- Store a second administrative key offline and test it before an incident.
- Allow the SSH port in both the provider firewall and the guest firewall, with IPv4 and IPv6 rules where required.
- Back up
/etc/sshand firewall configuration before major edits. - Monitor disk space, memory, and service health so resource exhaustion is visible before login fails.
- Test console access after provisioning and after changing firewall or network settings.
- Keep OpenSSH packages and operating-system security updates current instead of relying on obsolete cipher exceptions.
Frequently Asked Questions
Does a successful ping prove that SSH should work?
No. ICMP can be blocked while TCP SSH is allowed, or ICMP can work while the SSH port is filtered, closed, or served by a failed daemon. Test the specific TCP port instead.
Should I open SSH to 0.0.0.0/0 while troubleshooting?
Use the narrowest temporary source range possible. A broad allow rule increases exposure and should be removed immediately after you identify the correct address or repair the service.
Why does SSH work by IP address but not by hostname?
That points to DNS resolution, a stale record, or an address-family difference. Compare the hostname’s resolved A and AAAA records with the VPS addresses and test IPv4 or IPv6 explicitly.
What information should I include when asking for provider support?
Include the exact error, UTC timestamp, VPS identifier, destination address and port, source network, console availability, and the firewall or SSH changes already attempted.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
