We earn commissions when you shop through the links below. Learn more
How to Fix SSH Errors: Connection Refused, Permission Denied and More
Find your exact SSH error message below, see what it really means, and fix it with copy-and-paste commands. Covers connection refused, timed out, permission denied (publickey), host key changed and more.
Connection refusedPermission denied (publickey)Host key changedTimed out
Start here
Run SSH in verbose mode first
Almost every SSH problem explains itself if you add -v. It shows each step of the connection: which address it reaches, which keys it offers and exactly where it fails.
ssh -v user@203.0.113.10Use -vvv for even more detail. Read from the bottom up; the last few lines before the error usually name the problem.
Locked out completely?
Every major host has a browser-based console that works even when SSH doesn’t, such as the Droplet Console in DigitalOcean and View Console in Vultr. Log in there to read the SSH logs and fix the config:
sudo journalctl -u ssh -n 50Can’t reach the server
Connection refused, timed out and hostname errors
ssh: connect to host 203.0.113.10 port 22: Connection refused
What it means: Your computer reached the server, but nothing is listening on that port. The SSH service is stopped, or it runs on a different port.
How to fix it: Check the service with sudo systemctl status ssh and start it with sudo systemctl start ssh. See which port it uses with sudo ss -tlnp | grep ssh, then connect with ssh -p PORT.
ssh: connect to host 203.0.113.10 port 22: Connection timed out
What it means: Your connection never got an answer. The IP address is wrong, the server is off, or a firewall is silently dropping the traffic.
How to fix it: Double-check the IP in your dashboard and that the server is running. Make sure port 22 (or your custom port) is allowed in the server’s firewall, sudo ufw status, and in your provider’s cloud firewall or security group.
ssh: Could not resolve hostname myserver: Name or service not known
What it means: The name you typed isn’t a real domain, and isn’t a Host in your SSH config file.
How to fix it: Check for typos, connect with the IP address instead, or add the name to your ~/.ssh/config.
kex_exchange_identification: Connection closed by remote host
What it means: The server accepted the connection and immediately dropped it, often because your IP was banned by Fail2ban, or the server is overloaded.
How to fix it: Try again from a different network or after a few minutes. From the provider console, check sudo fail2ban-client status sshd and unban yourself with sudo fail2ban-client set sshd unbanip YOUR_IP.
Can’t log in
Permission denied and key errors
Permission denied (publickey)
What it means: The server only accepts keys, and it didn’t accept any key you offered.
How to fix it: Check you’re using the right username. Point to the right key with ssh -i ~/.ssh/id_ed25519 user@server. On the server, make sure your public key is in that user’s ~/.ssh/authorized_keys, with chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys.
Permission denied (publickey,password)
What it means: Both keys and passwords are allowed, and both failed.
How to fix it: Retype the password carefully (nothing appears as you type) and check the username. If you expected key login, make sure the key was added to the server for this user.
WARNING: UNPROTECTED PRIVATE KEY FILE!
What it means: Your private key can be read by other users on your computer, so SSH refuses to use it.
How to fix it: Run chmod 600 ~/.ssh/id_ed25519 on Mac or Linux. On Windows, remove other users from the file’s permissions in Properties → Security.
Received disconnect: Too many authentication failures
What it means: SSH offered too many keys from your agent before the right one, and the server gave up.
How to fix it: Connect with ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 user@server, or set IdentitiesOnly yes for that host in your SSH config.
Still stuck on permissions? On the server, sudo journalctl -u ssh often says “bad ownership or modes”. Your home folder must not be writable by other users either. Work out the right values with our Chmod Calculator.
Host keys
Host key changed and algorithm errors
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!
What it means: The server’s fingerprint is different from the one your computer saved. Usually it’s because the server was rebuilt or reinstalled.
How to fix it: If you rebuilt the server, remove the old fingerprint with ssh-keygen -R 203.0.113.10 and connect again. If you didn’t change anything, stop and check with your provider before connecting.
Unable to negotiate: no matching host key type found. Their offer: ssh-rsa
What it means: The server only offers the old SHA-1 ssh-rsa method, which modern OpenSSH turns off by default.
How to fix it: Update the old server if you can. As a temporary workaround for that one host, add HostKeyAlgorithms +ssh-rsa and PubkeyAcceptedAlgorithms +ssh-rsa to its entry in your SSH config.
Confused about RSA being “disabled”? Your RSA key still works; only the old signature method is off. Our Ed25519 vs RSA guide explains the difference.
Prevention
Avoid SSH errors in the first place
- Save each server’s user, port and key in your SSH config, so you never type them wrong.
- Keep one session open while changing SSH or firewall settings.
- Test config changes with
sudo sshd -tbefore restarting SSH. - Take a snapshot before big changes, so you can roll back.
Build your SSH config in a minute
Our free SSH Config Generator creates the file for you, with the right user, port, key and IdentitiesOnly setting for every server.
Need a server?
Sometimes a fresh server is the fastest fix
Spin up a clean VPS, add your SSH key when you create it, and you’re back in business in minutes.
DigitalOcean
Simple cloud servers with great docs. Add your SSH key when you create a Droplet.
From about $4/month
View DigitalOcean deals4 GB of RAM and NVMe storage on the entry VPS plan, with an easy control panel.
About $5.19/month on a 24-month term with our extra 20% off
Get 20% off Hostinger VPSYearly KVM VPS deals for about the price of one month elsewhere. Great for learning.
From about $11/year on promo
View RackNerd dealsPrices are approximate. Compare all VPS hosts, including Vultr and ShockHosting.
FAQ
SSH error questions, answered
What is the difference between connection refused and timed out?
Connection refused means the server answered but nothing is listening on that port. Timed out means nothing answered at all, usually because of a wrong IP address, a powered-off server or a firewall dropping the traffic.
Why does SSH say permission denied when my password is correct?
The server may not allow password logins at all, the username may be wrong, or root login may be disabled. Run ssh -v to see which login methods the server accepts.
Is it safe to remove a host key with ssh-keygen -R?
Yes, if you know why the key changed, for example because you rebuilt the server. If you did not change anything, the warning could mean someone is intercepting the connection, so check with your provider first.
How do I see SSH logs on the server?
On Ubuntu and Debian, run sudo journalctl -u ssh. On Red Hat-based systems the service is called sshd, so use sudo journalctl -u sshd.
Why did SSH stop working after I changed the port?
The firewall may still only allow port 22, or on Ubuntu 24.04 and later the port is set by ssh.socket rather than only the config file. Open the new port in the firewall and update ssh.socket.
Can a firewall cause SSH permission denied errors?
No. A firewall causes timeouts or refused connections, not permission errors. Permission denied always means the connection worked but the login itself failed.
Start fresh with a clean server
Sometimes the fastest fix is a new server set up the right way. Our beginner guide takes you from signup to a secure server in about 30 minutes.