Start by preserving the exact SSH error, then work from the outside in: verify the destination and port, check both firewall layers, confirm that sshd is listening, repair authentication and account permissions, and use the provider’s recovery console when normal SSH cannot reach the server. A timeout, refusal, authentication failure, and immediate disconnect occur at different stages, so each requires a different fix.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Identify the failure stage before changing anything
Copy the complete command and error message into a note. Do not begin by changing ports, keys, or firewall rules at random; a successful change can obscure the original fault and make recovery harder. The wording usually tells you which layer failed.
As an Amazon Associate I earn from qualifying purchases.
| Error | What it establishes | Most likely investigation |
|---|---|---|
ssh: connect to host 203.0.113.0 port 22: Connection timed out |
The client sent a connection attempt but received no response before its timeout. | Destination address, selected port, provider firewall, VPS firewall, routing, or a host that is down. |
ssh: connect to host 203.0.113.0 port 22: Connection refused |
The request reached the host, but nothing accepted it on that port (or the SSH service actively rejected it). | Wrong port, stopped or failed sshd, a binding error, or a host firewall rule that rejects rather than drops traffic. |
Permission denied (publickey) |
Network connection and an SSH handshake completed, but the server did not accept the offered credentials. | Username, private key selection, server-side public key, authentication settings, or file ownership and permissions. |
Connection closed or Connection reset |
The connection was established and then terminated, often during authentication or session startup. | Missing host keys, a crashed or misconfigured service, protocol incompatibility, account shell problems, or exhausted resources. |
Unable to negotiate ... no matching key exchange method found |
The client and server could not agree on a key-exchange algorithm. | Client/server SSH compatibility and the algorithms enabled in the server configuration. |
The timeout and refusal strings above are examples documented by DigitalOcean, not independent measurements. Treat the address and port in them as examples; use your own values when testing.
Confirm the VPS address and SSH port
Check the destination you are actually using
Confirm the VPS’s current public IP address or hostname in the provider control panel. A recreated VPS may have a different address, and a DNS name may still resolve to an old machine. Check for a typo in the username, hostname, and port in your command.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
ssh -vvv -p PORT USER@HOSTReplace PORT, USER, and HOST with your values. The verbose output should show the address and port the client is trying, DNS resolution, connection progress, key exchange, and authentication attempts. Save it before making changes; it is especially useful when you later use a recovery console.
Determine whether SSH still uses port 22
Port 22 is the default, but an administrator can change it with a Port directive in /etc/ssh/sshd_config or in an included configuration file. If you can access the server through a console, inspect the main file and any included files for every active Port line. The port in your client command must match the port on which sshd is listening.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ssh -p 2222 USER@HOSTUse the configured value rather than assuming 22. If a port was recently changed, allow the new port through both firewall layers before closing the existing administrative session.
Rule out a blocked client network
Some office, school, hotel, or mobile networks restrict outbound ports. Try the same destination and port from a different network that you are authorized to use. If it works elsewhere, the VPS may be healthy and the restriction is local to the original network. Do not infer that the server is down from one network’s timeout alone.
Check both firewall layers
A VPS commonly has a provider-level firewall or security group in front of the virtual machine and a second firewall inside the operating system. Both must permit the actual SSH port from your intended source address. Opening only one layer will not restore access.
Provider firewall or security group
- Open the VPS’s networking or firewall controls in the provider panel.
- Identify the inbound rule for the configured SSH port, not merely port 22.
- Confirm that the rule allows TCP traffic from your current public IP address or the intended network range.
- Check that the rule is attached to the correct VPS and is enabled. A rule created for an old instance does not protect or unlock a replacement.
- Apply the change and allow time for the provider control plane to enforce it, then retry with the exact port.
Restricting SSH to a known source address is safer than opening it to every address, but make sure your current address has not changed. If you need an emergency broad rule to regain access, narrow it immediately after testing.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Firewall inside the VPS
Use the firewall tool installed on the operating system. Ubuntu commonly uses UFW; CentOS often uses firewalld; systems without those tools may use iptables.
| Firewall | Useful inspection command | What to verify |
|---|---|---|
| UFW | ufw status |
The active profile allows the configured SSH port and is not denying your source. |
| firewalld | firewall-cmd --list-services |
The SSH service or an explicit rule covers the port in the active zone. |
| iptables | iptables -nL |
Input rules, policy, and source restrictions permit the port and return traffic. |
Run these through the provider console if SSH is unavailable. Check the active zone or ruleset rather than editing a configuration file that is not loaded. A rule can appear correct while a different zone, interface, or provider filter still blocks the connection.
Interpret the firewall symptom
- A dropped packet commonly produces a timeout.
- An explicit reject or an unbound port commonly produces connection refused.
- A firewall that permits the handshake does not guarantee a login; authentication and account checks happen later.
Verify that sshd is running and listening
Use a web, serial, or recovery console when normal SSH cannot provide server-side evidence. The exact service unit can vary, but the live service is commonly called ssh.service or managed by an sshd unit.
Check service state and logs
systemctl status ssh
journalctl -u ssh --no-pager
If your distribution uses an sshd unit, substitute that name. Look for startup failures, syntax errors, permission problems, missing host keys, and bind errors such as an address or port already in use. The status output tells you whether the service is active; the log explains why it failed or exited.
Validate configuration before restarting
Inspect /etc/ssh/sshd_config and every file it includes. A single malformed directive can prevent a restart. Validate the effective configuration before applying it:
sshd -tNo output normally indicates that the syntax check passed. If it reports a line or file, correct that specific problem through the console, validate again, and only then restart the service.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Confirm the listening socket
ss -ltnpFind the configured SSH port in the listening sockets. Confirm the address as well: a service bound only to a local interface cannot accept connections arriving on the VPS’s public address. If nothing is listening, fix the service or configuration before adjusting client keys.
Recover from a bad port change safely
If you changed Port and lost access, use the console to add a known-good listening port temporarily, allow it through both firewalls, validate the configuration, and restart. Keep an already-open SSH session until a new session succeeds. Remove the temporary port after confirming the intended port works.
Repair “Permission denied (publickey)”
This message means the network path and SSH service are reachable. Concentrate on identity and account configuration rather than firewalls.
Use the correct username
Cloud images often disable direct login for one account and provide a distribution-specific administrative user. Verify the username shown in the provider’s VPS details and the username that owns the installed key. A valid private key offered to the wrong account will still fail.
Make sure the client offers the intended private key
ssh -vvv -i /path/to/private_key -p PORT USER@HOSTIn the verbose output, check that the file is read and offered. If an SSH agent is loaded with many keys, the client may try different identities before reaching the server’s limit. Explicitly selecting the key removes that ambiguity. Protect the private key locally; never copy it into authorized_keys or paste it into a public support channel.
Check the server-side public key
For the login account, the matching public key must appear as one complete line in ~/.ssh/authorized_keys. Ensure it was installed for the same account named in the SSH command and that it was not wrapped across lines or altered during copying. If the account’s home directory changed, the tilde path may point somewhere different than expected.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Correct ownership and permissions
The recommended permissions are:
~/.ssh: mode700, owned by the login account.~/.ssh/authorized_keys: mode600, owned by the login account.
Use the recovery console or another administrator account to inspect ownership and modes. A directory or file owned by root, writable by other users, or inaccessible to the login account can cause the server to ignore an otherwise correct key. Also check the home directory’s ownership and traversal permissions.
Confirm authentication methods are enabled
Inspect the effective SSH configuration for public-key authentication and any account-specific rules. A restrictive AllowUsers, DenyUsers, group rule, or disabled public-key method can reject the correct key. Review the SSH service log while making one login attempt; it usually identifies whether the key was absent, rejected by policy, or blocked by file permissions.
Handle negotiation, host-key, and protocol errors
“No matching key exchange method found”
The documented example Unable to negotiate with 203.0.113.0: no matching key exchange method found. indicates that the client and server have no common key-exchange algorithm. First update or use a supported SSH client and inspect the server’s enabled algorithms. Do not permanently enable obsolete algorithms merely to bypass the message; they may weaken the connection. If a temporary compatibility override is unavoidable, apply it only to the affected host, use it long enough to update the server or client, and remove it afterward.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Missing host keys or a damaged sshd installation
“Connection closed” or “connection reset” during the handshake can follow missing host keys, a failed service startup, or a process crash. Use the console to inspect service logs and the host-key files, then regenerate or reinstall them only after preserving configuration and verifying the correct ownership. A blind reinstall can overwrite settings or make host-identity changes that surprise other administrators.
Separate client warnings from server failure
Verbose output shows whether the disconnect occurs before key exchange, during authentication, or after authentication. Match that point with the server’s live log. If the server log contains no attempt at all, continue investigating the address, port, and firewalls; if it records the user and then closes the session, move to account and resource checks.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When SSH authenticates but the session closes immediately
A successful handshake is not the same as a usable shell. Check the post-authentication environment in this order.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Home directory
Confirm that the account’s home directory exists, is owned by the account, and is traversable. A missing or inaccessible home directory can terminate the session before a prompt appears. Correct the path in the account record if it points to a moved or deleted directory.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallLogin shell
Verify that the account’s shell is a real executable shell rather than /usr/sbin/nologin or /bin/false. Those values intentionally prevent interactive sessions. If the account should be interactive, select the appropriate shell through the console and confirm the change before testing again.
Forced commands and startup files
Inspect the account’s SSH key options and shell startup files for commands that exit immediately, change directories to a missing path, or invoke a program that is no longer installed. Test with a simple command to distinguish shell startup from network failure:
ssh -p PORT USER@HOST 'id'If a command executes but an interactive session closes, focus on the shell, startup scripts, and terminal allocation. If even a simple command closes, use the server log and account configuration for the next evidence.
Memory and open-file capacity
Resource exhaustion can prevent a usable shell even when the network path and credentials work. Through the console, check whether the VPS is out of memory or has exhausted its open-file capacity. Look for service or kernel messages around the login time. Free enough resources to start a shell, then investigate the process or workload that consumed them; repeatedly restarting SSH without addressing exhaustion will not be durable.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsUse the recovery console when normal SSH is locked out
The provider’s web or serial recovery console is the safest administrative path after a firewall or SSH configuration change blocks remote access. It does not depend on the broken SSH path.
- Open the console from the control panel and authenticate with an administrative account or emergency credentials.
- Record the current service status, active firewall rules, configured SSH port, and recent SSH logs before editing.
- Undo the smallest change that caused the lockout: restore the prior port, permit the port in the OS firewall, repair a syntax error, or restore the correct key and ownership.
- Validate the SSH configuration and firewall state.
- Restart or reload the SSH service only after validation.
- From a separate terminal, test a new SSH session while leaving the console session and any existing SSH session open.
- Once access is confirmed, remove emergency firewall openings or temporary ports and document the final configuration.
If the console shows irreversible filesystem or network damage, stop making blind changes. Prioritize a verified backup, data recovery, or redeployment. Repeated edits can destroy evidence and increase the chance of losing data.
Quick Recap
A practical decision path
- Capture the exact error. Run one verbose attempt and note the destination and port.
- Verify the address and port. Check DNS or the provider panel and inspect the server’s
Portdirectives if you have console access. - Classify the result. Timeout points to reachability; refusal points to listening or rejection; public-key denial points to identity; immediate closure points to protocol, shell, or resources.
- Check both firewalls. Confirm provider rules and the VPS’s UFW, firewalld, or iptables rules for the actual port and source.
- Verify
sshd. Check service status, logs, configuration syntax, and listening sockets. - Repair authentication. Use the right account and key, then verify
authorized_keys, ownership, and modes. - Check the shell phase. Verify home directory, shell, startup behavior, memory, and open-file capacity.
- Test from a different network. This isolates local outbound filtering from VPS-side faults.
- Escalate through the console. Restore a known-good configuration, test safely, and redeploy when damage is not reliably reversible.
Prevent the next lockout
- Keep one administrative SSH session open while changing ports, firewall rules, or authentication settings.
- Validate configuration syntax before restarting
sshd. - Permit the new SSH port at the provider and VPS firewalls before removing the old rule.
- Record the configured port, administrative usernames, key owners, and recovery-console location in a secure runbook.
- Test a fresh session from a second terminal and, when practical, from a second network after every access change.
- Maintain a current backup or redeployment plan; a recovery console is an access path, not a substitute for recoverable data.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
