SSH platform diagnostics for 25 environments
Compare SSH diagnostic boundaries, recovery paths, read-only checks, and first-party documentation across Linux, cloud, CI, macOS, Windows, and bastions.
SSH banner timeout
TCP connects, but the server does not send its SSH identification before the client or server grace period expires.
SSH Match and Include order
The effective option comes from an unexpected Host, Match, or Include block because OpenSSH generally keeps the first obtained value.
SSH exit code 255
SSH reports its generic fatal-error code, while the useful cause appears earlier in stderr or verbose output.
Lost SSH private key recovery
The private key is missing or unreadable; because private keys cannot be reconstructed from public keys, access must be recovered through another trusted path.
SSH permission denied (publickey)
The network connection succeeds, but the server rejects every public key the client offers.
SSH port forwarding not working
SSH authenticates, but the local, remote, or dynamic forwarding endpoint cannot carry the expected application traffic.
SSH ProxyJump not working
The client cannot complete one of the distinct hops from local machine to bastion to target.
SCP legacy protocol compatibility
Modern scp uses SFTP by default, but an older server or unusual shell expects legacy SCP behavior and fails differently.
SSH user certificate expired
Public-key authentication uses a signed user certificate whose valid-before time has passed or whose client and server clocks disagree.
SSH X11 forwarding not working
The SSH session works but remote X applications cannot connect to the locally forwarded display.