SSH Debugging
Step 1: Check SSH Client Command
Start by ensuring the SSH command you're using is correct. For example:
bash
CopyEdit
ssh user@hostname_or_ip
Ensure you're using the correct username and hostname/IP address. Also, confirm that the
port (if non-standard) is specified:
bash
CopyEdit
ssh -p <port_number> user@hostname_or_ip
Step 2: Verify SSH Server is Running
Make sure the SSH server (sshd) is running on the remote machine.
● On Linux/Unix:
Check if the sshd service is active:
bash
CopyEdit
sudo systemctl status sshd
If not running, start the service:
bash
CopyEdit
sudo systemctl start sshd
○
● On Windows (OpenSSH Server):
Check the status using the Windows Services Manager or PowerShell:
powershell
CopyEdit
Get-Service -Name sshd
○
Step 3: Check SSH Port Availability
By default, SSH listens on port 22, but it might be configured to use a different port.
● Verify if port 22 (or your custom port) is open:
On the remote machine, use netstat or ss:
bash
CopyEdit
sudo netstat -tuln | grep :22
Alternatively, you can use ss:
bash
CopyEdit
sudo ss -tuln | grep :22
On the client machine, you can check if the port is reachable using telnet or nc:
bash
CopyEdit
telnet hostname_or_ip 22
or
bash
CopyEdit
nc -zv hostname_or_ip 22
If the port is closed, make sure the firewall on the remote machine allows inbound connections
on the SSH port.
Step 4: Verify Firewall Rules
If there's a firewall (either on the client or server), check if it's blocking SSH traffic.
● On Linux:
For ufw (Uncomplicated Firewall):
bash
CopyEdit
sudo ufw status
Ensure the rule allows SSH:
bash
CopyEdit
sudo ufw allow ssh
If using iptables:
bash
CopyEdit
sudo iptables -L
○
● On Windows:
○ Ensure that the Windows Firewall allows inbound SSH connections on port 22.
Step 5: Check SSH Configuration File (Server-Side)
Ensure the SSH configuration (/etc/ssh/sshd_config) is correct on the server.
● Common misconfigurations include:
○ PermitRootLogin set to no (if you're trying to log in as root).
○ PasswordAuthentication set to no (if you're using password authentication
and not keys).
○ Incorrect ListenAddress that prevents SSH from binding to the correct
interface.
Check the SSH configuration file:
bash
CopyEdit
sudo nano /etc/ssh/sshd_config
After modifying the configuration, restart the SSH service:
bash
CopyEdit
sudo systemctl restart sshd
Step 6: Review Logs for Errors
Check the logs for any errors related to SSH authentication or connections.
● On the server:
Check the SSH logs in /var/log/[Link] (Debian-based systems) or /var/log/secure
(Red Hat-based systems):
bash
CopyEdit
sudo tail -f /var/log/[Link]
or
bash
CopyEdit
sudo tail -f /var/log/secure
○
● Look for entries like:
○ Connection refused.
○ Authentication failures.
○ Incorrect configuration.
Step 7: Check Authentication Method
If you're using public key authentication, ensure the following:
1. The public key is correctly added to the remote server in ~/.ssh/authorized_keys
for the user you're trying to log in as.
2. The private key is present on your client machine and has the correct permissions.
Ensure the ~/.ssh directory and its contents have the correct permissions:
bash
CopyEdit
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
3.
● If you’re using password authentication, check that PasswordAuthentication is
set to yes in the /etc/ssh/sshd_config file.
Step 8: Debugging with Verbose Mode
Run SSH in verbose mode to get more detailed output:
bash
CopyEdit
ssh -v user@hostname_or_ip
If that doesn't provide enough detail, increase the verbosity:
bash
CopyEdit
ssh -vvv user@hostname_or_ip
This will show detailed logs of the SSH connection process, including authentication steps, key
exchange, and any errors.
Step 9: Check Network Connectivity
Ensure the client machine can reach the server over the network. Check if the remote server is
up and reachable:
Ping the server:
bash
CopyEdit
ping hostname_or_ip
●
● If the server is not reachable via ping, the issue might be with the network or the firewall
settings.
Step 10: Restart SSH Client and Server
Sometimes restarting both the client and the server can resolve connectivity issues.
On the server:
bash
CopyEdit
sudo systemctl restart sshd
●
● On the client: Close and reopen your SSH client session.
Step 11: Check for Resource Limitations
Ensure the server isn’t overwhelmed by too many active SSH sessions. If there are too many
open connections, it may refuse new ones.
● Check for maximum connections in the sshd_config file (MaxSessions and
MaxStartups).
Step 12: Test with Another Machine
If the issue persists, try SSHing from a different machine. If that works, the problem might be
specific to your client machine (e.g., incorrect configuration, network issues, etc.).
Summary of Common Troubleshooting Commands
Client-side Debugging (verbose mode):
bash
CopyEdit
ssh -vvv user@hostname_or_ip
Check SSH service status (server):
bash
CopyEdit
sudo systemctl status sshd
Check firewall rules:
bash
CopyEdit
sudo ufw status
sudo iptables -L
Check logs (server):
bash
CopyEdit
sudo tail -f /var/log/[Link]