Start on the client
Replace user and server.example with your real account and host. Connection refused means a connection was actively rejected; timeout can indicate routing, filtering or an unresponsive endpoint. Permission denied means authentication was rejected. Verbose logs can contain identifying information; redact them before sharing.
ssh -vvv -o ConnectTimeout=5 -p 22 user@server.example
ssh -4 -o ConnectTimeout=5 user@server.example
ssh -6 -o ConnectTimeout=5 user@server.exampleCheck Linux through its console
For Ubuntu or Debian, inspect the ssh service, listening sockets, configuration syntax and journal. Confirm the actual port and both firewall directions. A timeout is not proof the machine is off. Other distributions may use sshd.service. Keep console access while making changes.
sudo systemctl status ssh.service
sudo ss -lntp
sudo /usr/sbin/sshd -t
sudo journalctl -u ssh.service -n 50 --no-pagerRepair authentication without weakening trust
Confirm the username, selected private key and server-side authorized_keys ownership and permissions. IdentitiesOnly tests the intended key. A changed host key must be checked through an independent trusted channel; do not disable StrictHostKeyChecking or blindly delete known_hosts. CH-J Diagnostics can test TCP reachability without SSH login.
ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519_chj user@server.example
ssh-keygen -F server.example