SSH Errors

This error occurs when the SSH daemon fails to start the requested subsystem (like SFTP or SCP) for your connection. Common causes include misconfigured subsystem paths, missing binaries, corrupted user profiles, or authentication issues.

This error occurs when an SFTP connection is abruptly terminated before the operation completes. It typically indicates a server-side issue, network instability, missing SFTP subsystem configuration, or server resource constraints.

This sshd error occurs when SSH authentication attempts are made with a username that doesn't exist on the remote system, or when user access is restricted by sshd configuration. The message appears in server logs when login is rejected.

The 'lost connection' error in SCP occurs when the SSH connection is unexpectedly dropped during file transfer. This can happen due to network issues, SSH protocol incompatibilities, or command path problems on the remote host.

SSH connections hang indefinitely during the key exchange phase, displaying the debug message 'expecting SSH2_MSG_KEX_ECDH_REPLY'. This is typically caused by network path MTU issues, firewall rules blocking fragmentation packets, or ICMP configuration problems that prevent proper key exchange negotiation.

This warning appears when SSH cannot find or access the identity file (private key) at the specified path. It typically indicates the key file doesn't exist, the path is incorrect, or the file has been moved.

This SSH warning appears when the host key for a remote server doesn't match the stored fingerprint in your known_hosts file, which can indicate DNS spoofing, server changes, or IP address reuse. Usually this is benign but requires verification.

This error occurs when the SSH server fails to allocate a terminal (PTY) or shell session for your connection. Common causes include semaphore exhaustion, misconfigured /dev/pts mount options, SSH settings restrictions, or system resource limits.

This SSH error occurs when a user's group is explicitly denied in sshd_config via DenyGroups. Fix it by removing the group restriction, using a Match override, or removing the user from the denied group.

This SSH error occurs when a user is explicitly blocked by the DenyUsers directive in sshd_config. Remove the user from the DenyUsers list and restart the SSH service to restore access.

This SSH error occurs when a user's group membership does not match the AllowGroups directive in sshd_config. The fix involves adding the user's group to the allowed groups list or verifying group membership.

This error occurs when sshd_config restricts SSH login to specific users via the AllowUsers directive. Fix it by adding your username to the AllowUsers list in sshd_config and restarting the SSH service.

SSH shows "The agent has no identities" when ssh-agent is running but has no keys loaded. Add your private key to the agent using ssh-add to resolve this connection issue.

SSH client and server have incompatible encryption algorithms (ciphers). Modern SSH clients disable weak legacy ciphers by default, causing connections to older servers to fail. Fix by enabling legacy ciphers in your client configuration.

This SSH error indicates the server closed the connection before authentication completed. Common causes include too many failed login attempts, authentication method mismatches, or failed brute-force attacks.

PAM (Pluggable Authentication Modules) authentication fails during SSH login. This typically means the authentication module rejected the credentials or user account. Common causes include incorrect passwords, disabled user accounts, invalid PAM configuration, or SSH/PAM incompatibilities after system updates.

The SSH agent is running but has no private keys loaded. This error occurs when attempting to use ssh-add without first adding SSH keys to the agent. Fix by generating SSH keys, starting the SSH agent, and explicitly adding your keys.

The SSH server resets the TCP connection before authentication completes. This usually stems from network issues, brute-force attempts, or client timeout during key exchange.

The "Received message too long" error in SFTP occurs when shell startup scripts output text that corrupts the SFTP protocol stream. The error number is actually the first four bytes of the output interpreted as a packet size.

SSH authentication failed because the password you entered is incorrect, or the user account doesn't have password authentication enabled. Common causes include wrong credentials, disabled password auth, or account restrictions.

The 'Connection closed by invalid user' message appears in sshd server logs when someone attempts to SSH into your server using a username that doesn't exist on the system. This is a security event (usually an automated attack) and is normal on any publicly accessible SSH server.

This error occurs when SSH clients exceed the server's maximum authentication attempts limit (default: 6). It's a security mechanism to prevent brute-force attacks. Resolve it by specifying the correct key, reducing failed attempts, or increasing MaxAuthTries on the server.

The "Accepted publickey for user" message is a success indicator in SSH daemon logs showing that a user successfully authenticated using public key authentication. Understanding this log entry helps with security auditing, troubleshooting authentication issues, and identifying which SSH key was used for login.

The "Failed publickey for user" message appears in sshd logs when an SSH client attempts public key authentication but the server rejects the key. This indicates a mismatch between the client's key and the server's authorized_keys, or the server doesn't recognize the key algorithm.

This error occurs when an SFTP connection is abruptly terminated by the server during transfer. Common causes include chroot directory permission issues, IP blocking from failed attempts, network timeouts, firewall restrictions, or key exchange algorithm mismatches.

This error occurs when SCP protocol receives a filename that doesn't match the request, due to OpenSSH security validations or special characters in filenames. It can also happen with paths containing colons or dots that require escaping.

This error occurs when scp cannot locate the file or directory you're trying to transfer. Common causes include incorrect file paths, typos, relative path confusion, or the file not existing at the specified location.

This SSH warning occurs when you run commands with piped or redirected input without allocating a terminal. The fix involves using SSH flags like -t, -tt, or -T depending on your use case.

The scp permission denied error occurs when your user account lacks read permissions on the source file or write permissions on the destination directory. This commonly happens due to file ownership mismatches, missing SSH keys, or incorrect file permissions on the remote server.

This error occurs when the SSH client cannot complete the initial banner exchange with the server due to network interruption, firewall blocking, or server misconfiguration. It typically means the connection was closed unexpectedly during the protocol identification phase.

The "stdin is not a tty" error occurs when SSH tries to run a command without allocating a proper terminal (TTY). This typically happens when piping input or running scripts remotely. Use the -t flag to force terminal allocation.

This error occurs when the SSH connection is unexpectedly terminated by the remote server during the authentication or communication phase. The server closes the TCP connection without properly completing the SSH protocol handshake, often due to server configuration issues, firewall blocking, or resource constraints.

This SSH error occurs when the server cannot allocate a pseudo-terminal (PTY) for your session. It typically appears with git operations, SFTP transfers, or interactive SSH connections and is usually non-fatal but indicates the server rejected TTY allocation.

The SSH client cannot reach the remote server on port 22 within the timeout period. The packet_write_poll error indicates the TCP connection attempt failed to establish. This typically means a firewall is blocking the connection, the SSH service isn't running, or there are network routing issues.

SSH 'Host key has changed' error occurs when the remote server's SSH key fingerprint no longer matches what's stored locally. This is a security feature designed to prevent man-in-the-middle attacks. Common causes include server reinstallation, IP reassignment, DNS changes, or legitimate key rotation.

This error occurs during SSH port forwarding (tunneling) when the target service is not running, listening on the wrong port, or blocked by a firewall. The SSH connection succeeds, but the forwarded connection to the remote service fails.

This warning appears when SSH detects that a remote server's host key has changed since you last connected to it. The offending key is stored in your known_hosts file, and SSH refuses to connect until you remove or update the old key entry.

This error occurs when you try to start the SSH daemon without using its full absolute path. sshd enforces this security requirement to prevent PATH manipulation attacks and to ensure the re-exec mechanism works correctly.

SSH channel open requests are rejected due to server-side policy restrictions. This commonly occurs when port forwarding is disabled in sshd_config or when tunneling operations are restricted for security reasons.

The SSH daemon (sshd) is rejecting incoming connections from a specific hostname or IP address. This typically indicates TCP wrapper restrictions, firewall rules, or service misconfiguration preventing client access.

This error occurs when SSH detects a mismatch between the host key stored locally and the key presented by the remote server. It typically happens after server reinstallation, key rotation, or network configuration changes. You can fix this by removing the old key from your known_hosts file.

This error occurs when your SSH client and the remote SSH server cannot agree on a common encryption cipher. Modern SSH clients disable older, weaker ciphers by default for security, causing connections to legacy servers to fail.

SSH fails with "Permission denied (keyboard-interactive)" when the server denies authentication attempts using keyboard-interactive methods, often due to authentication method configuration issues, disabled password authentication, or misconfigured authorized_keys.

The SSH client cannot reach the remote server on port 22 within the timeout period. This typically indicates a firewall blocking the connection, the SSH service not running, or network connectivity problems between your machine and the host.

SSH throws a 'missing argument' error when a command-line option or config file keyword doesn't have its required value. This typically happens with flags like -p, -i, or -o that expect arguments, or with malformed SSH config files.

SSH fails to connect or initialize when your .ssh/config file contains invalid or misspelled configuration options. This error occurs during SSH parsing and prevents any connections from being established.

SSH port forwarding fails when the client cannot bind to a local or remote port. This typically happens when the port is already in use, you lack permissions, or there are conflicting SSH configurations.

SSH connection fails with 'Permission denied (publickey,keyboard-interactive)' when the server rejects both public key and keyboard-interactive authentication methods. This typically indicates missing keys, incorrect permissions, or server configuration issues.

SSH unknown option errors occur when an invalid or mistyped command-line flag is passed to the ssh command. This commonly happens due to typos, using double-dashes instead of single-dashes, or trying to use options that don't exist in your SSH version.

This error occurs when your SSH client cannot establish a connection to the remote server on port 22. It typically indicates the SSH service is not running, the port is blocked by a firewall, or the server is unreachable.

SSH local port forwarding fails when the specified local port is already in use by another process. This occurs when establishing tunnels with the -L flag and attempting to bind to a port that another service occupies.

SSH automatically generates host keys when the SSH server starts for the first time. This message is normal and expected on new systems or fresh containers, but can be concerning if it happens unexpectedly on an existing server.

OpenSSH rejects the chroot directory because it has incorrect ownership or permissions. The directory must be owned by root and not writable by group or other users, for security reasons.

This error occurs when the SSH server on a remote host unexpectedly closes the connection after accepting the TCP connection but before or immediately after authentication. It usually indicates server-side configuration issues, resource constraints, or authentication failures rather than network problems.

This error occurs when the SSH client or server specifies an invalid or unsupported Message Authentication Code (MAC) algorithm in its configuration. It typically indicates a typo, deprecated algorithm, or incompatible SSH version.

The SSH key exchange phase fails when the remote server closes the connection before completing the identification handshake. This typically occurs due to network issues, firewall blocks, server overload, or configuration mismatches.

SSH cannot translate the hostname to an IP address due to DNS resolution failures, incorrect hostname spelling, network connectivity issues, or misconfigured DNS settings. Fix by verifying hostname spelling, checking DNS resolution, updating /etc/hosts, or using the IP address directly.

This message appears in SSH logs when the SSH daemon (sshd) receives signal 15 (SIGTERM), a graceful termination request. It typically indicates a service restart or system shutdown, not necessarily a connection error.

The SSH client receives a connection reset error during the key exchange phase when attempting to establish an SSH connection. This typically indicates a network issue, firewall blocking, or SSH server misconfiguration.

This warning occurs when SSH stores different ECDSA keys for the same host accessed via both its hostname and IP address. It typically appears after a server reinstall, key regeneration, or when connecting via multiple identifiers. The warning is usually harmless but indicates SSH can't verify the connection is to the expected host.

This error occurs when the SSH server (sshd) denies a channel opening request for port forwarding, tunneling, or subsystem operations. It means the server is configured to administratively prohibit the requested operation, even though the authentication succeeded.

This error occurs when an SSH client (or server) exceeds the maximum number of authentication attempts. The SSH daemon disconnects the connection to prevent brute force attacks and excessive failed login attempts.

This error occurs when the SSH server abruptly closes the connection during the key exchange phase, before authentication completes. Common causes include firewall blocks, IP bans, misconfigured SSH service, or network issues.

The SSH daemon (sshd) cannot start because it cannot find or access its host keys. Host keys are cryptographic credentials that identify the SSH server to clients, and they must exist and be accessible for sshd to operate. This error typically occurs after a fresh installation, accidental deletion, or permission changes that prevent sshd from reading the keys.

This error occurs when an SSH client cannot establish a TCP connection to the SSH server on the remote host. It typically indicates a network connectivity issue, incorrect hostname/port, or the SSH service isn't running or accessible.

This error occurs when the SSH client or server encounters an invalid or misspelled configuration option. It typically indicates a typo in your SSH config file, use of a deprecated option, or an option that's not supported by your SSH version.

This error occurs when the SSH client detects that a server's ECDSA host key has changed from what is stored locally. It's a security warning that prevents automatic connection to the server, requiring you to verify that the host hasn't been compromised or replaced.

The 'Network is unreachable' SSH error occurs when the client machine cannot establish a network route to the remote host. This typically results from missing network connectivity, incorrect routing configuration, firewall blocking, or the remote host being offline. Unlike connection refused errors, this indicates the network path itself is unavailable, not that the SSH service is unreachable.

This error occurs when the SSH server abruptly terminates the connection during the key exchange phase, before authentication completes. It's typically caused by firewall blocking, network issues, server misconfiguration, or resource exhaustion.

The SSH key exchange process is interrupted when the remote server closes the connection before authentication can complete. This typically indicates network issues, firewall blocking, server overload, or security restrictions.

This error occurs when the SSH client tries too many authentication methods before the server's maximum attempt limit is reached. The server disconnects to prevent brute force attacks. Usually caused by offering too many SSH keys or having multiple identity files configured.

The ssh-keygen command prompts for confirmation when an SSH key file already exists at the target location. You need to decide whether to overwrite the existing key, use a different filename, or keep the existing key.

This error appears when SSH detects that a host's key has changed since you last connected. It's a critical security check that prevents man-in-the-middle attacks, but is often triggered legitimately when servers are reinstalled, IP addresses are reassigned, or infrastructure is recreated.

The SSH daemon (sshd) fails to start with "fatal: Cannot bind any address" when it cannot listen on the configured address or port. Common causes include address family mismatches, ports already in use, network startup timing issues, and SELinux permission restrictions. Most solutions involve fixing sshd configuration or checking service startup order.

This error occurs when the SSH client and server cannot agree on a Message Authentication Code (MAC) algorithm during the connection negotiation phase. It happens when newer SSH clients attempt to connect to older servers, or when security policies have disabled certain algorithms.

This error occurs when the SSH server abruptly closes the connection during the protocol handshake, before authentication is completed. It typically indicates server-side configuration issues, resource constraints, or firewall restrictions rather than a networking connectivity problem.

This error occurs when SSH cannot resolve a hostname due to DNS failures. Check your internet connection, verify DNS server configuration, and ensure your firewall isn't blocking DNS queries (port 53).

This error occurs when SSH cannot verify the authenticity of a remote host's key because it doesn't exist in your known_hosts file or has changed. It's a security feature that prevents man-in-the-middle attacks but requires manual verification the first time you connect to a host.

This SSH error appears when authentication fails due to incorrect credentials, disabled password authentication, or mismatched SSH keys. It typically occurs when logging in with password or public key authentication. Resolve it by verifying credentials, enabling password authentication on the server, or ensuring your SSH keys are properly configured.

The SSH server terminated your connection unexpectedly, usually due to inactivity timeouts, network issues, or misconfigured keepalive settings. This can happen during idle sessions or when firewall rules drop inactive connections.

The "client_loop: send disconnect: Broken pipe" error occurs when an idle SSH connection is terminated by the server, firewall, or NAT device due to inactivity timeout. It's common in remote work and cloud environments where keepalive settings aren't configured.

SSH shows 'type -1' when it cannot find or load an identity file. This usually means the key file doesn't exist at the specified path or cannot be read. While often a harmless informational message, it indicates SSH is falling back to other authentication methods.

SSH authentication failed occurs when the server rejects your login credentials or keys. This can happen due to incorrect credentials, permission issues with key files, wrong key usage, or server configuration mismatches.

SSH authentication fails when the SSH agent cannot sign your key. This typically occurs when your SSH key isn't loaded in the agent or the agent has configuration issues, preventing authentication to GitHub or other SSH servers.

SSH shows this warning when the remote host's key fingerprint has changed or doesn't match your stored record. This is a critical security alert that requires verification before proceeding, as it could indicate a man-in-the-middle attack or a legitimate server change.

SSH refuses to use private key files with overly permissive permissions (0644, 0755, etc). Private keys must be restricted to the owner only (mode 600 or 400) for security.

The "This private key will be ignored" warning appears when your SSH private key file has permissions that are too permissive. SSH is strict about key file security and will refuse to use keys that are readable by other users. Fixing this requires restricting the file permissions to be readable only by the owner.

This error occurs when SSH tools like ssh-add try to communicate with the SSH agent, but the SSH_AUTH_SOCK environment variable points to a nonexistent or inaccessible socket file. It typically means the SSH agent isn't running or the socket path is misconfigured.

This error occurs when OpenSSH cannot load or parse a public key file due to format incompatibility or corruption. It typically indicates the key file is in an unsupported format (PuTTY format, malformed, or outdated OpenSSH version) or corrupted with extraneous characters or line breaks.

This error occurs when you try to use an SSH key through ssh-add or during git operations, but the SSH agent is not running or the SSH_AUTH_SOCK environment variable is not set correctly. The SSH agent is responsible for managing your SSH keys and providing them to SSH clients when needed.

The "no such identity" error occurs when SSH cannot find the private key file specified in your SSH configuration or command. This typically happens when the key file doesn't exist, has been moved, or the path is incorrect. Resolving this requires verifying the key file exists and fixing its path.

This error occurs when your SSH private key has overly permissive file permissions. SSH refuses to use the key for security reasons, requiring file access restricted to your user only to prevent unauthorized access to your private key.

This error occurs when the SSH server closes the connection before the key exchange process completes. It's typically caused by server-side restrictions, resource limits, IP blocking, or SSH daemon issues.

SSH client and server cannot agree on an encryption algorithm. This occurs when connecting newer SSH clients to legacy servers, or when ciphers are disabled for security reasons.

SSH connection fails when GSSAPI authentication methods are attempted but credentials cannot be verified. This occurs when public key or GSSAPI-based authentication is misconfigured on either the client or server side.

This error occurs when an SSH connection is unexpectedly terminated, typically due to network inactivity, firewall timeouts, or server disconnection. The connection breaks while attempting to send data to the remote host.

The SSH connection unexpectedly closed because the TCP connection was terminated. This usually happens when an idle session times out or network connectivity is lost.

This message appears when the SSH server you're connected to is shutting down or rebooting. The connection is abruptly closed by the remote system, usually due to scheduled maintenance, manual shutdown command, or system crash.

This error indicates the SSH client cannot establish a network path to the remote host. It typically means the target server is unreachable due to network connectivity issues, firewall blocks, routing problems, or the host being offline.

The "Connection from hostname port XXXXX on hostname port 22 rdomain" message is a standard informational log entry from sshd (SSH daemon) that records incoming client connections. It indicates a successful socket connection before authentication attempts.

The SSH "no hostkey alg" error occurs when the SSH client and server cannot agree on a compatible host key algorithm. This typically happens when connecting older SSH clients to newer servers with strict algorithm policies.

The "Saving key failed" error occurs when ssh-keygen cannot write the generated SSH key files to the specified directory. This is typically caused by missing .ssh directory, incorrect file permissions, or insufficient disk space. Fix it by ensuring the directory exists with proper permissions and disk space is available.

This error occurs when you try to generate an SSH key with a type that ssh-keygen doesn't recognize or support. It's usually caused by a typo in the key type name, using an unsupported algorithm on your OpenSSH version, or trying to use deprecated key types.

This error occurs when the SSH daemon (sshd) cannot bind to port 22 because another process is already listening on it. Common causes include duplicate sshd instances, IPv6/IPv4 binding conflicts, or configuration issues.

The "Corrupted MAC on input" error occurs when SSH's Message Authentication Code (MAC) verification fails during connection, indicating either network packet corruption, MAC algorithm incompatibility between client and server, or hardware issues. This error prevents successful SSH authentication and can usually be resolved by changing the MAC algorithm or investigating network stability.

This error occurs when OpenSSH client and server cannot agree on Diffie-Hellman key exchange parameters. Modern OpenSSH requires minimum 2048-bit moduli, but some legacy systems only support 1024-bit keys, causing the connection to fail.

This error occurs when SSH cannot write a key file to disk. Common causes include permission issues on the .ssh directory, insufficient disk space, or a read-only filesystem. The fix depends on identifying whether the problem is permissions, storage, or file system access.

The SSH daemon (sshd) cannot bind to port 22 because another process is already using it, or a previous sshd instance hasn't fully released the port. This error specifically indicates an IPv6 binding conflict (the :: address) and occurs during server startup.

SSH remote port forwarding (reverse tunneling) fails when the remote server cannot bind to the specified port. This typically happens due to port conflicts, privilege restrictions, or SSH server misconfiguration.

X11 forwarding fails when SSH is misconfigured or missing required dependencies. This error occurs when the SSH server cannot establish an X11 tunnel to display graphical applications on your local machine.

This warning appears when SSH connects to a server for the first time (or after the server's host key changes) and stores the host's public key fingerprint in your known_hosts file. It's an informational message, not an error, but indicates that SSH is learning a new host identity for future verification.

This error occurs when your SSH configuration file (~/.ssh/config) contains an unrecognized or unsupported option. It's typically caused by typos, unsupported options for your SSH version, or platform-specific settings used on an incompatible system.

This error occurs when your SSH client and server cannot agree on a host key algorithm for authentication. Modern OpenSSH versions (8.8+) disabled legacy algorithms like ssh-rsa for security reasons, causing connection failures with older servers still using these algorithms.

The remote server's SSH host key no longer matches what's stored in your known_hosts file. This warning protects against man-in-the-middle attacks but usually indicates a legitimate server change. You can safely resolve it by removing the old key.

This error occurs when your SSH client and server cannot agree on a compatible key exchange algorithm. Older servers may only support deprecated algorithms that modern SSH clients disable by default for security.

The "Permission denied (publickey)" error occurs when SSH cannot verify your identity using public key authentication. This typically results from missing SSH keys, incorrect file permissions, or the public key not being registered on the server.

This error occurs when SSH port forwarding or remote command execution fails because the destination host is unreachable or the connection times out before establishing a channel. Common causes include firewall rules, network timeouts, incorrect host/port, or disabled TCP forwarding on the SSH server.

This error occurs when the ssh-add command cannot communicate with the SSH agent process. The agent may not be running, the socket file may be missing, or environment variables may be misconfigured. This is a common issue on new terminal sessions or after system restarts.

The SSH "Access denied" error occurs when the SSH server rejects your authentication attempt. This is usually due to incorrect credentials, misconfigured keys, disabled authentication methods, or account/group restrictions on the server.

This error occurs when SSH authentication succeeds but the session is immediately terminated by the server after the user authenticates. It typically indicates file permission issues, configuration problems, or incompatible authentication settings between client and server.

The "Host is down" error occurs when SSH cannot reach the remote server at the network level. This indicates a network connectivity issue—the target host is unreachable, offline, or has network problems preventing any communication.

This error occurs when SSH (client or daemon) tries to bind to a port that is already in use by another process or service. Fix it by finding the conflicting process and either terminating it, changing the SSH port, or waiting for socket cleanup.

This warning appears when SSH detects that a remote server's host key has changed. It prevents connections as a security measure to detect potential man-in-the-middle attacks or legitimate server reinstallations. The fix involves removing the old key from your local known_hosts file.

The 'Connection closed by UNKNOWN port 65535' error occurs when an SSH connection is terminated before completing the key exchange and authentication process. This typically indicates a proxy/firewall issue, incompatible key exchange algorithms, authentication failures, or network connectivity problems between your client and the SSH server.

The "Permission denied (publickey,password)" error means SSH authentication failed using both public key and password methods. Both authentication methods were either disabled on the server or the credentials provided don't match what the server expects. This is one of the most common SSH connection problems.

This error occurs when SSH has exhausted all available authentication methods on the remote server without successfully authenticating. It means the client tried every configured authentication method but all were rejected, usually because the required credentials weren't provided or don't match what's configured on the server.

This error occurs when SSH cannot communicate with the ssh-agent service, typically because the agent isn't running. Restart the agent using eval "$(ssh-agent -s)" to resolve the issue.

This error occurs when the SSH agent refuses to sign a key operation, typically due to incorrect file permissions on your private key or agent authentication issues. It prevents SSH authentication even when the key exists locally.

This error occurs when SSH refuses to read your configuration file because it has incorrect file permissions or ownership. SSH strictly requires the .ssh directory and its contents to be readable only by your user account, not by group or others.

SSH enforces strict file permissions to prevent unauthorized access to your private keys. This error occurs when SSH detects that your private key file has permissions that are too permissive (world-readable or group-readable), which could expose your credentials to other users on the system.

SSH refuses to connect when the ~/.ssh/known_hosts file has incorrect permissions or is owned by the wrong user. This is a security check SSH performs to prevent unauthorized file modifications from compromising your connections.

This error occurs when an SSH client and server cannot agree on a mutually supported signature algorithm for public key authentication. It typically happens when using deprecated RSA keys with newer OpenSSH versions (8.8+) that disabled SHA-1 signatures, or when connecting to legacy servers that don't support modern signature algorithms.

The 'Load key invalid format' error occurs when OpenSSH cannot parse your private key file because it's in an incompatible format. This commonly happens when the key is in the newer OpenSSH format (introduced in OpenSSH 7.8) but your SSH client or tool expects the traditional PEM format.

The "WARNING: UNPROTECTED PRIVATE KEY FILE!" warning appears when your SSH private key file has overly permissive permissions. OpenSSH requires private keys to be readable only by you (mode 600 or 400) as a security measure. When permissions are too open, SSH refuses to use the key and falls back to password authentication.

This warning appears when SSH detects that a server's host key has changed since your last connection. While it could indicate a real attack, it's often caused by legitimate server maintenance, reinstalls, or key rotations. Learn how to verify the change is legitimate and safely reconnect.