SSH bad owner or permissions
OpenSSH refuses a config, private key, authorized_keys file, or home-directory path because another identity can modify it.
SSH banner exchange invalid format
The TCP endpoint replies, but the bytes received before SSH identification are not valid for an SSH transport.
SSH banner timeout
TCP connects, but the server does not send its SSH identification before the client or server grace period expires.
SSH certificate principal mismatch
A certificate is correctly signed but does not authorize the requested user or host principal.
Change an SSH key passphrase safely
The private key is valid, but its local encryption passphrase needs to be added or changed without replacing server authorization.
SSH Match and Include order
The effective option comes from an unexpected Host, Match, or Include block because OpenSSH generally keeps the first obtained value.
SSH config file not applied
The effective hostname, user, port, key, or proxy differs from what the operator believes the config declares.
SSH preauth connection closed
The server logs a disconnect before authentication finishes; this may be normal client abandonment or a clue to method, policy, or resource failure.
SSH connection refused
The destination actively rejects the TCP connection, usually because nothing is listening at that address and port.
SSH connection reset by peer
A TCP connection starts and is then closed abruptly by the server, firewall, proxy, or connection limiter.
SSH connection timed out
The client cannot complete a TCP connection to the expected SSH endpoint before its deadline.
SSH ControlPath too long
Connection multiplexing cannot create its Unix-domain control socket because the expanded path exceeds the platform limit or collides with another target.
SSH SOCKS proxy not working
The -D listener exists or should exist, but applications do not route DNS and TCP traffic through the dynamic SOCKS proxy as intended.
SSH exit code 255
SSH reports its generic fatal-error code, while the useful cause appears earlier in stderr or verbose output.
Load an SSH FIDO resident key
The key handle is stored on a FIDO2 authenticator and must be discovered or loaded on a new client without exposing private material.
SSH security key touch not detected
An ed25519-sk or ecdsa-sk identity is selected, but the FIDO authenticator, middleware, user-presence gesture, or verification step does not complete.
SSH GatewayPorts exposure
A forwarded port intended for local use is reachable from other machines because its bind policy exposes it beyond loopback.
Verify an SSH host certificate
The server presents a CA-signed host certificate, so the client must validate its signing CA, host principals, validity interval, and critical metadata.
SSH host key changed warning
The host now presents a key that differs from the key saved for that hostname or address.
SSH could not resolve hostname
The client cannot turn the supplied SSH host name into an address, or an alias is being resolved by DNS instead of SSH config.
SSH to an IPv6 link-local address
A fe80:: link-local address is ambiguous without the interface scope that identifies which local link should carry the connection.
SSH IPv6 network is unreachable
DNS or an explicit address selects IPv6, but the client has no usable route or the path blocks IPv6 before SSH begins.
SSH keeps disconnecting
An established session disappears after idle time or network changes, often because an intermediary expires state or the host stops responding.
Fix kex_exchange_identification
The SSH connection closes before or during initial key exchange, often because of pre-auth policy, rate limits, wrong routing, or incompatible early protocol behavior.