# SSH Problems
Troubleshooting SSH connectivity issues.
## Connection Refused
**Symptom:** `ssh: connect to host X port Y: Connection refused`
**Causes and solutions:**
### Wrong SSH port
```bash
# Check configured port
auberge config get ssh_port
# Try connecting with correct port (replace PORT with your configured ssh_port)
ssh -p PORT ansible@vps-ip
```
### Firewall blocking port
```bash
# Check provider firewall in control panel
# Ensure custom SSH port is allowed
```
### SSH service not running
```bash
# Connect via provider console (VNC)
sudo systemctl status sshd
sudo systemctl start sshd
```
## Permission Denied
**Symptom:** `Permission denied (publickey)`
**Causes and solutions:**
### SSH key not authorized
```bash
# Verify public key is on server
ssh ansible@vps "cat ~/.ssh/authorized_keys"
# Re-add key manually (via provider console)
cat ~/.ssh/identities/ansible_vps.pub # Copy this
# Paste into VPS ~/.ssh/authorized_keys
```
### Wrong SSH key
```bash
# Specify correct key
ssh -i ~/.ssh/identities/ansible_vps ansible@vps-ip -p $SSH_PORT
```
### Key permissions too open
```bash
# Fix permissions
chmod 600 ~/.ssh/identities/ansible_vps
```
### Wrong user
```bash
# Use correct user
ssh ansible@vps-ip # Not root after bootstrap
```
## Host Key Verification Failed
**Symptom:** `Host key verification failed`
**Causes:**
- VPS was reinstalled (new host key)
- Man-in-the-middle attack (rare)
**Solution:**
```bash
# Remove old host key
ssh-keygen -R vps-ip
ssh-keygen -R [vps-ip]:custom-port
# Reconnect (will add new key)
ssh ansible@vps-ip
```
## Connection Timeout
**Symptom:** `ssh: connect to host X port Y: Connection timed out`
**Causes and solutions:**
### Wrong IP address
```bash
# Verify IP
ping vps-ip
# Check host configuration
auberge host list
```
### VPS offline
```bash
# Check VPS status in provider control panel
# Restart VPS if needed
```
### Network issues
```bash
# Test connectivity
ping vps-ip
traceroute vps-ip
# Try from different network
```
## Stale Control Sockets
**Symptom:** Ansible hangs or fails with "ControlPersist" error
**Solution:**
```bash
# Remove stale sockets
rm -rf ~/.ssh/ctl-*
rm -rf /tmp/ssh-*
# Retry connection
ssh ansible@vps-ip
```
## After Bootstrap Lockout
**Symptom:** Cannot connect after running bootstrap
**Causes:**
1. Provider firewall not configured
2. SSH port change failed
3. SSH keys not deployed
**Recovery:**
```bash
# Access via provider console (VNC/serial)
# Check SSH is running
sudo systemctl status sshd
# Check SSH port
sudo grep "^Port" /etc/ssh/sshd_config
# Check firewall
sudo ufw status
# If locked out:
# Option 1: Disable firewall temporarily
sudo ufw disable
# Option 2: Reset to port 22
sudo sed -i 's/^Port.*/Port 22/' /etc/ssh/sshd_config
sudo systemctl restart sshd
sudo ufw allow 22/tcp
sudo ufw enable
# Fix issues, then re-run bootstrap
```
## SSH Debugging
Enable verbose output:
```bash
# Level 1 (basic)
ssh -v ansible@vps-ip
# Level 2 (detailed)
ssh -vv ansible@vps-ip
# Level 3 (very detailed)
ssh -vvv ansible@vps-ip
```
Common debug info:
- Which keys are tried
- Authentication methods
- Connection progress
- Error details
## Ansible SSH Issues
### Ansible cannot connect
```bash
# Test with ansible directly
ansible -i ansible/inventory.yml vps -m ping
# Run with verbose
auberge ansible run --host vps -vvv
```
### Wrong ansible_user
Check `ansible/inventory.yml`:
```yaml
ansible_user: ansible # Should be 'ansible' not 'root' after bootstrap
```
## Related Pages
- [SSH Keys Configuration](configuration/ssh-keys.md)
- [Bootstrap](deployment/bootstrap.md)
- [Ansible Inventory](configuration/ansible-inventory.md)