In this guide
The four stages of an SSH connection
Network connection
The SSH client reaches a host and TCP port, commonly port 22.
Server identification
The server presents a host key. Your client checks it against a known or trusted fingerprint.
Encrypted session
Client and server negotiate algorithms and create protected session keys.
User authentication
The server verifies your account using an approved method such as a public key, password, or hardware-backed credential.
Connect with a command-line SSH client
A typical OpenSSH command identifies the username and destination. Add a nonstandard port only when your administrator specifies one.
Examples are placeholders. Do not probe systems or attempt access without authorization.
Verify the host before authenticating
On a new connection, compare the SHA-256 host key fingerprint with a value obtained from an administrator, inventory, or another trusted channel. A matching hostname alone is not enough.
If a previously known host key changes, stop and investigate. Legitimate causes include a server rebuild or key rotation, but the same warning can indicate redirection or interception.
Troubleshoot by layer
- Timeout: check hostname, network route, VPN requirement, firewall, and port.
- Connection refused: verify the port and whether the SSH service is running.
- Host key warning: do not remove the old key until the change is independently verified.
- Permission denied: verify username, authorized key, key selection, and account policy.
- Session closes: review server policy, shell access, and permitted commands with the system owner.
Close the session cleanly
Exit the remote shell, confirm that local forwarding has stopped, and close the client. For shared or managed workstations, follow the organization’s rules for clearing agents, temporary files, and session logs.