Common SSH Protocol Errors and Fixes

SSH is the primary method for managing Vultr Compute Instances. However, misconfigurations, service errors, or encryption mismatches can make the SSH protocol handshake fail. This guide explains how to troubleshoot such SSH protocol-level issues.

Pre-Troubleshooting Checklist

Before troubleshooting SSH directly, complete the following checks:

1. Log in to the Vultr Customer Portal and ensure.

   • The instance is Running.
   • There are no reported network outages.
   • The firewall is not blocking port 22 (default SSH port).

2. If your SSH access is broken, use the Vultr View Console option from the portal to access the instance directly, even if networking is down.

3. Use the Server Restart option from the instance's Overview tab in the Vultr Customer Portal. Rebooting the server can often resolve basic SSH or networking issues caused by temporary misconfigurations or service failures.

1. Host Key Verification Failed

   Error Message (OpenSSH):

   @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
   @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
   @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

   Cause:

   • Rebuilding instance from snapshot.
   • Reinstalling OpenSSH server.
   • IP reassignment with new host key.

   Fix (OpenSSH):

   console Copy

   $ ssh-keygen -R `<SERVER-IP>`
   

   Explain Code

2. Connection Closed or Reset by Peer.

   Error Message:

   Connection closed by 192.0.2.123 port 22

   Causes:

   • SSH service is not yet started.
   • SSH host keys are missing.
   • SSH crashes on connection.

   Fix:

   Access web console and run the below commands:

   console Copy

   $ sudo systemctl status sshd
   $ sudo ssh-keygen -A     # Regenerate host keys if missing
   $ sudo systemctl restart sshd
   

   Explain Code

3. Cipher Mismatch or Key Exchange.

   Error Message:

   Unable to negotiate with 192.0.2.123: no matching key exchange method found.

   Cause:

   Server supports only legacy ciphers (e.g., diffie-hellman-group1-sha1)

   Fix (OpenSSH):

   console Copy

   $ ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 <username>@<SERVER-IP>
   

   Explain Code