Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
When SSH fails, first identify whether the problem is the address and network path, the server’s SSH service, or authentication. A running virtual machine is not proof that any of those layers works. Confirm the instance and endpoint, classify the exact error, collect verbose client evidence, then use an alternate management channel—such as an agent session, instance-connect feature, or serial console—to repair the server. If every channel fails, use the provider’s documented rescue or offline-disk workflow.
Start with a five-minute triage
Do not begin by changing firewall rules or replacing keys at random. Each SSH message narrows the failure to a different layer. Work from the outside in and record what you observe before making changes.
Free tools Windows power users keep installed
One-click scans. No signup required.
1. Confirm the machine and endpoint
- Verify that the server or virtual machine is actually running and has passed the hosting provider’s status checks. A powered-on state does not prove that the operating system finished booting or that networking is healthy.
- Confirm the current public DNS name or IP address. Addresses can change after a stop/start operation unless a static address is attached.
- Check the intended login account for the image or distribution. Cloud images often use a distribution-specific account rather than
root. - Locate the private key that matches the public key installed for that account. A key from another instance will produce an authentication failure, not a network fix.
- Ensure the private-key file is protected from group and other users. With OpenSSH on Unix-like systems, a mode such as
chmod 400 key_pair.pemis commonly accepted; use the permissions required by your client.
Write down the exact command, destination, username, and time of each attempt. That record prevents a changed address or a second server from being mistaken for the original fault.
2. Read the error as a layer indicator
| Message or symptom | What it establishes | First checks |
|---|---|---|
Connection timed out |
The client did not receive a response from the destination path before its timeout. | DNS or address, route, security group, network ACL, provider firewall, local firewall, host firewall, and whether TCP port 22 is reachable. |
Connection refused |
The host was reached, but no SSH service accepted the connection on that port, or the host actively rejected it. | Whether sshd is running, the configured listening port, port conflicts, and host-firewall rules. |
Permission denied or Server refused our key |
Network communication reached SSH, but login authentication failed. | Exact username, matching private key, authorized-key entry, and key-file permissions. |
| Blank console, frozen boot, or no login prompt | The console channel may be working while the operating system is stalled, or the console itself may not be available. | Provider and serial-console status, boot and system logs, and recovery options. Capture diagnostics before rebooting. |
A timeout and a refusal are not interchangeable. A timeout normally sends you toward addressing and filtering; a refusal sends you toward the listener and service state. An authentication error is evidence that the path and SSH daemon were reached, so changing routing or security groups is unlikely to help.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Collect client-side evidence before changing the server
Test TCP reachability
From the client network, test the destination port directly:
nc -zv HOST 22Replace HOST with the exact DNS name or address used in your SSH command. A successful connection indicates that something is accepting TCP on that path; it does not prove that authentication will succeed. A timeout points back to routing or filtering. A refusal indicates that the host answered but no service accepted that port.
Recommended Free Tools
If netcat is unavailable, use an equivalent approved TCP-port test on your operating system. Test from another network only when doing so is permitted by your organization; a result that changes between networks can reveal a local egress filter or route problem.
Run OpenSSH in verbose mode
ssh -i key_pair.pem user@HOST -vvvThe verbose trace shows where the attempt stops:
- DNS or address-resolution lines identify a wrong or stale endpoint.
- TCP connection lines show whether a route and port response were obtained.
- Host-key lines indicate that the server was reached far enough to identify itself. A changed host key should be investigated rather than bypassed blindly.
- Public-key offer and authentication lines reveal a wrong username, wrong private key, absent authorized key, or rejected key permissions.
Save the trace, but redact private material before sharing it. A verbose log should not contain the private-key contents, yet it can disclose hostnames, usernames, and network details.
Map the symptom to the likely failure layer
Timeout: inspect the complete path
Check the address returned by DNS, the route from the client, and every control that can drop unsolicited inbound traffic. In a hosted environment that commonly means the instance security group, subnet network ACL, provider-level firewall, and the operating system’s firewall. Confirm that the server is intended to accept SSH on port 22; some administrators deliberately move SSH to another port, in which case testing only port 22 gives a false conclusion.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Also check local conditions: a corporate VPN, endpoint firewall, captive network, or egress policy can prevent the request from leaving the client. Compare the result with a known-good path only if the comparison uses an authorized test host.
Refusal: inspect the listener and daemon
A refusal means the destination host responded. Use an alternate channel if possible and determine whether the SSH daemon is stopped, failed during startup, bound to a different port, or competing with another process. A host firewall can also reject traffic after the host is reached. Do not infer that the virtual machine is healthy merely because the provider marks it running; the SSH service can still be down.
Authentication failure: verify identity, not networking
Check the account name for the installed image, then verify that the private key corresponds to a public key in that account’s authorized-keys file. Confirm that the home directory, .ssh directory, and authorized-key file are owned and protected as required by the operating system. The client’s -vvv output will show which key it offers and whether the server rejects it. Correct the key or account first; opening additional network ports will not repair a rejected credential.
Use an alternate management path when SSH is down
A second channel is often safer than trying to repair a locked-out server from the network edge. The exact names, permissions, regions, images, and account requirements vary by provider and operating system.
| Recovery path | Requires port 22? | Typical prerequisites | Useful when | Limits to check |
|---|---|---|---|---|
| Agent-based session service | No | A preinstalled, running agent and the required identity or access role. | The network path or sshd is broken but the operating system and agent can run. |
It may not work during an early boot failure, and access is governed by provider permissions and audit settings. |
| Instance-connect feature | Usually no long-lived key exchange, but provider networking still applies | Supported image, account permissions, and provider-side connectivity. | Short-lived access when your normal private key is unavailable. | Availability differs by image, region, account, and operating system; it cannot repair a machine that never reaches the required service state. |
| Serial console | No | Provider and account support, plus console permission. | Boot problems, broken networking, or a failed SSH daemon. | It may expose only a text console and can be unavailable for some instance types or regions. |
| Rescue instance or offline disk attachment | No connection to the affected guest is required | Permission to stop or detach the disk and attach it to a helper system. | The guest cannot boot or every online management path fails. | Changes are offline and easier to get wrong; preserve logs and configuration before editing. |
Use the provider’s documented implementation for the platform you operate. AWS guidance, for example, describes Session Manager, EC2 Instance Connect, EC2 Serial Console, and a rescue-instance workflow; equivalent facilities on another host may have different names and prerequisites.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Repair SSH from an alternate shell
Once you have an authorized shell through an agent session, instance-connect feature, serial console, or rescue environment, proceed in a narrow sequence. Keep a copy of configuration and logs before broad edits.
1. Check service state
sudo systemctl status sshdSome distributions register the unit as ssh rather than sshd. Use the service name used by that operating system. If the unit is inactive or failed, inspect the reason before restarting it.
2. Read recent service logs
sudo journalctl -u sshd --no-pager -n 50If the distribution uses the ssh unit, substitute that name. Look for configuration parse errors, missing host keys, permission failures, address-binding errors, or dependency failures. The last 50 entries are a starting point; expand the window when the failure occurred earlier.
3. Validate configuration without restarting
sudo sshd -tThis syntax check is a focused test. Correct the reported directive, include-file path, or permission problem, then run the check again. Do not restart a daemon with an unvalidated configuration: a typo can turn a recoverable session into a second lockout.
4. Recreate missing host keys
sudo ssh-keygen -ARun this when logs show that the server lacks its host keys. Host-key recreation changes the identity presented to clients, so investigate and document the change; clients may display a host-key warning on the next connection.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
5. Confirm the listener and port
sudo ss -tlnp | grep :22This shows whether a process is listening on TCP port 22. If no listener appears, compare the daemon configuration with the port you are testing. If another process owns the port, resolve that conflict rather than repeatedly restarting SSH.
6. Correct keys, ownership, and permissions
For the affected account, verify the authorized-key entry, ownership of the home and SSH directories, and restrictive permissions on the key files. A syntactically valid key can still be refused when the server considers the path insecure. Make the smallest correction possible and preserve the original file for comparison.
7. Repair missing packages or dependencies
If logs show that the OpenSSH server binary or a required dependency is missing, reinstall the server package using the operating system’s supported package manager and repository. Record the package operation and confirm that it completed without leaving the system in a partially configured state.
8. Restart and retest
After sshd -t succeeds and the listener is correct, restart the service with the distribution’s service name, check its status again, and test from the original client using the exact username, address, and key. Keep the alternate channel open until the normal SSH login succeeds.
When no online management path works
Use the provider’s rescue or disk-attachment procedure to inspect the affected filesystem from a helper system. This is an offline repair, not a substitute for understanding the failure.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
- Capture any available provider events, console output, and instance status before stopping or detaching anything.
- Follow the provider’s documented process to stop the affected machine when required, detach its boot volume, and attach that volume to a rescue system.
- Mount the filesystem read-only first when practical. Copy SSH configuration, authentication logs, boot logs, and firewall configuration to a separate location.
- Check for an invalid SSH configuration, missing host keys, damaged packages, full filesystems, or incorrect ownership and permissions.
- Make one controlled repair, unmount cleanly, reattach the disk to the original machine, and test the console before making additional changes.
If the filesystem is encrypted, the rescue workflow may require the original key-management process. Provider-specific console names, disk commands, and boot tooling differ, so do not substitute instructions for another operating system or platform.
If the console is blank or the server will not boot
A blank console is not automatically an SSH problem. Determine whether the provider reports a healthy instance, whether the serial channel is enabled, and whether any boot output appears. If output stops during boot, capture it before rebooting. A reboot can clear the most useful evidence and may worsen a filesystem or package problem.
Use the serial or provider console to inspect system logs and recent kernel or service failures. If the machine repeatedly fails before networking starts, move to the rescue workflow rather than spending time on security-group changes. If the console works but SSH does not, return to the service, listener, and firewall checks above.
After access is restored
- Test both the normal SSH path and at least one approved alternate path while the system is healthy.
- Record the correct endpoint, account name, key location, listening port, and provider recovery prerequisites in your runbook.
- Monitor SSH service failures, boot failures, disk usage, and provider status checks.
- Keep an emergency access method configured before you need it, including the required agent, identity role, console permission, or rescue procedure.
- Review every temporary firewall, key, package, and configuration change made during recovery and remove anything that is no longer required.
The reliable sequence is evidence first: prove the endpoint, distinguish timeout from refusal or authentication failure, test the port and verbose SSH stages, then repair the daemon or credentials through a separate channel. A running VM is only one observation; network reachability, SSH listener state, and authentication must each be verified independently.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
