SSH Debugging

Verbose mode is the answer to almost every SSH question

When SSH doesn't do what you expected, ssh -v prints the entire authentication conversation — what the client offered, what the server accepted, which key files were tried, which permission checks passed. The first 30 lines of -v output answer most "why isn't this working?" questions in under a minute.

Three levels: -v (basic), -vv (more), -vvv (everything, often too much).

What to look for in -v output

Good signs:

debug1: Connecting to 192.168.1.100 port 22.
debug1: Connection established.
debug1: Offering public key: /Users/you_username/.ssh/id_ed25519
debug1: Authentication succeeded (publickey).

Bad signs:

debug1: identity file ~/.ssh/id_ed25519 type -1   ← key not found / unreadable
debug1: No more authentication methods to try.
Permission denied (publickey,password).

The classic failure modes

Symptom	Likely cause	Fix
Connection refused	sshd not running, firewall blocking	Check daemon, check firewall, check port
Permission denied (publickey)	Key not in authorized_keys, or perms wrong	`chmod 700 ~/.ssh; chmod 600 authorized_keys`
Permission denied (publickey,password)	Wrong key tried first, or wrong username	Check -v output for which keys are tried
Host key verification failed	Server reinstalled, key changed	`ssh-keygen -R host` if expected
Hangs forever	Firewall silently dropping packets	`ssh -o ConnectTimeout=5`

Code

Three levels of verbose·bash

ssh -v you_username@192.168.1.100
ssh -vv you_username@192.168.1.100
ssh -vvv you_username@192.168.1.100

# Useful flags for diagnostics
ssh -o ConnectTimeout=5 -v user@host       # don't hang on bad routes
ssh -o BatchMode=yes user@host             # never prompt — fail instead
ssh -o StrictHostKeyChecking=no user@host  # skip TOFU prompt (use carefully)

# Force a specific key
ssh -i ~/.ssh/id_ed25519_alt user@host

# Test if the port even responds
nc -zv host 22

Exercise

Take one machine you SSH into often and run ssh -v to it. Read every line. Identify: (1) which IP/port it connected to, (2) which host key type was used, (3) which client key files were tried in order, (4) which one succeeded. This 30-second exercise turns SSH from a black box into a transparent thing whose every step you can see.