Why Is My SSH Connection Failing?

How the SSH connection analyzer works

OpenSSH verbose output follows the connection in order: configuration evaluation, name resolution, TCP connection, identification exchange, algorithm negotiation, host-key verification, identity offering, authentication, and session setup. The analyzer looks for exact errors in those stages and explains what has already succeeded.

Collect the effective configuration as well as the error

ssh -vvv destination.example
ssh -G destination.example
ssh-add -l

ssh -G is especially useful because Host, Match, Include, ProxyJump, ProxyCommand, IdentityFile, and user settings can combine in ways that are not obvious from one configuration file.

Separate transport from authentication

A connection timeout or refusal happens before SSH authentication. Changing keys will not correct routing, firewall, port, or jump-host access. Conversely, Permission denied (publickey) means the client reached the SSH server and completed transport negotiation. At that point, inspect the user, selected keys, agent, authorized keys, server policy, and authentication logs.

Treat host-key warnings as security checks

Do not automatically delete a known-host entry when SSH reports that identification changed. Confirm the new fingerprint through a trusted administrative path first. Server rebuilds and address reuse are common explanations, but the warning exists to stop undetected impersonation.

Test jump hosts one hop at a time

ProxyJump and ProxyCommand errors can make the final message look as if it came from the destination. Connect to the jump host directly, then test destination DNS and port reachability from that host. The misleading UNKNOWN port 65535 message is a good example of why the first failed hop matters more than the final line.