How do I collect useful SSH diagnostic output safely?
SSH verbose mode shows connection setup and authentication decisions. Start with -v and increase detail only if the first output does not explain the failure. Diagnostic logs can reveal account names, hostnames and local paths even without passwords.
Instructions
1. Reproduce one bounded attempt
Use the known endpoint, a short timeout and the intended identity if key selection matters.
ssh -v -o ConnectTimeout=10 -o ConnectionAttempts=1 adminuser@203.0.113.10 hostname
$LASTEXITCODEThe read-only remote command confirms which host answers if login succeeds. Capture the native status immediately.
2. Identify the failing stage
Look for DNS or TCP connection failure, host-key rejection, key offering, authentication acceptance, or a remote command error. Report the exact error and stage instead of only saying SSH is broken.
3. Share only the relevant redacted lines
Remove usernames, private hostnames, sensitive directory names and any application data. Never attach private-key files or passwords. Include the client version, timestamp, destination port and whether the same test succeeds from another authorised network.
Check the result
- The report contains the actual SSH error and its stage.
- Private credentials and unnecessary infrastructure details are absent.
Troubleshooting
- Verbose output scrolls too quickly
- Capture it in an approved private diagnostic location or copy the relevant terminal section; avoid public paste sites.
- The log only says remote command failed
- Authentication may have succeeded. Inspect the specific remote command and its exit status.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.