Common SSH Error Messages
| Error | Likely Cause |
|---|---|
Connection timed out | Firewall blocking port 22 |
Connection refused | SSH daemon not running |
Permission denied (publickey) | Wrong key or key not authorised |
Host key verification failed | Server IP changed |
No route to host | Server offline or network issue |
Step 1 — Verify the Server Is Running
Check the server status in the LightYear control panel. If it shows stopped or error, start or rebuild it.
Step 2 — Check Firewall Rules
Ensure port 22 (or your custom SSH port) is allowed from your IP:
- Go to Network → Firewall Groups → [Your Group].
- Verify there is an Accept rule for TCP port 22 from your IP.
Test with:
$nc -zv <SERVER_IP> 22$# Connection to <SERVER_IP> 22 port [tcp/ssh] succeeded!Step 3 — Verify Your SSH Key
$# Test with verbose output$ssh -v -i ~/.ssh/your_key root@<SERVER_IP>Look for:
debug1: Offering public key: /home/user/.ssh/your_key
debug1: Server accepts key
If the key is rejected:
$# Check the key is in authorized_keys (via VNC console)$cat /root/.ssh/authorized_keysStep 4 — Use the VNC Console
If SSH is completely inaccessible, use the browser-based VNC console:
- Go to Servers → [Your Server] → Console.
- Log in with the root password (shown in server details).
- Check SSH daemon status:
$systemctl status sshd$# If not running:$systemctl start sshdStep 5 — Clear the Known Hosts Entry
If the server was rebuilt and the IP reused:
$ssh-keygen -R <SERVER_IP>Step 6 — Check SSH Logs
Via VNC console:
$journalctl -u sshd -n 50$# or$tail -50 /var/log/auth.logChecklist
- Server status is active
- Firewall allows TCP port 22 from your IP
- Correct SSH key selected
- SSH daemon is running
- Known hosts entry cleared after rebuild
