Connection Issues
Fix SSH connection failures in CtrlOps. Diagnose timeouts, key errors, firewall rules, and security groups for AWS, GCP, Azure, DigitalOcean - in minutes.
You hit New Connection, fill in the form, click Connect SSH, and instead of landing in your server you see "Connection Failed" or "Taking longer than usual". This page walks through the most common causes and exact fixes.
How to Diagnose SSH Connection Failures
- Why a "Connection failed" error appears and how to read every row of the modal.
- Copying the full error report to share with support or the AI Assistant.
- Fixing wrong username, wrong key, or wrong IP.
- Firewall and security group fixes for AWS, GCP, Azure, DigitalOcean.
- What to do when CtrlOps says "Windows Server Not Supported".
- When to use the SSH Setup Wizard.
First, find the exact error
When a connection fails, CtrlOps opens a Connection failed modal that breaks the failure down rather than dumping a raw SSH string at you. Read it top to bottom:
| Row | What it tells you |
|---|---|
| Server | The saved connection name, so you know which server this is about |
| Address | The user@ip:port CtrlOps actually dialled. Check this first, a typo here explains a surprising share of failures |
| Failed at | The stage that broke, e.g. Dialling (TCP + SSH handshake). This alone splits network problems from auth problems |
| Took | How long it tried before giving up. A full 45 seconds points at a firewall silently dropping packets; a failure in under a second points at auth or a refused port |
| Error | A category / code pair such as network / PreflightTimeout |
Under that, What happened is a timestamped timeline of the attempt, marking which lines came from the app and which from SSH, so you can see exactly where it stalled. Three buttons sit at the bottom: Close, Try again, and Copy report.
The error wording still matters most. Scan the table below to find your case:
| What the error says | Most likely cause |
|---|---|
| "Connection timed out" | Firewall or security group blocking port 22 |
| "Connection refused" | SSH service isn't running on the server |
| "Permission denied (publickey, password)" | Wrong username, wrong password, or wrong key |
| "Host key verification failed" | Server's identity changed since you last connected |
| "Network unreachable" | DNS or routing problem |
| "Taking longer than usual" | Slow server, slow network, or wrong IP |
| "Windows Server Not Supported" | The server is running Windows; use a Linux server instead |
Copy the full error report
Click Copy report (bottom right of the Connection failed modal)
This puts the whole failure on your clipboard as plain text: the server name, the address dialled, the stage it failed at, how long it took, the error category and code, and the complete What happened timeline. Paste it straight into Discord, an email, or the AI Assistant instead of retyping an error message from memory or a screenshot.
The report is safe to share. It carries the address CtrlOps dialled and the trace of what happened, never your password or the contents of your private key.
Common problems and fixes
The whole failure, as plain text: the server name, the user@ip:port CtrlOps dialled, the stage it failed at, how long it tried, the error category and code, and the full What happened timeline.
Paste it into Discord, an email, or the CtrlOps AI Assistant instead of retyping the error or attaching a screenshot. It contains the address and the failure trace only, never your password or private key.
This is the most common error. CtrlOps reached the server, but the username, password, or key was rejected.
Check the username first. Different distros use different defaults:
| Server type | Default username |
|---|---|
| Ubuntu (AWS, DigitalOcean) | ubuntu |
| Amazon Linux (AWS) | ec2-user |
| Debian | debian |
| CentOS / Rocky / AlmaLinux | centos or root |
| Most VPS providers | root |
If you're using a .pem key: make sure permissions on your local machine are tight. From your local terminal:
chmod 600 ~/path/to/yourkey.pemIf you're using a password: confirm password authentication is enabled on the server. SSH into it another way and check /etc/ssh/sshd_config for PasswordAuthentication yes.
Click Edit on the connection card → Fix the username or re-pick the key → Click Connect again.
The server isn't responding on port 22 within 30 seconds. The cause is almost always a firewall.
Check your cloud provider's security group:
| Provider | Where to look |
|---|---|
| AWS | EC2 Console → Security Groups → Inbound rules → allow TCP 22 from your IP |
| DigitalOcean | Networking → Cloud Firewalls → Inbound Rules → allow SSH |
| GCP | VPC Network → Firewall → allow tcp:22 |
| Azure | Network Security Group → Inbound security rules → allow SSH |
Check the server-side firewall by SSHing in another way (cloud console, mobile hotspot, or the provider's web shell):
sudo ufw status
sudo ufw allow 22/tcp
sudo ufw reloadIf your office network blocks port 22, try a mobile hotspot or VPN to confirm. Some corporate networks block outbound SSH.
The server is reachable but the SSH service isn't accepting connections. This means SSH is stopped, crashed, or listening on a different port.
Get into the server through your cloud provider's web console (the "in-browser shell" most providers offer), then check SSH:
sudo systemctl status ssh
sudo systemctl start ssh
sudo systemctl enable sshIf SSH is running on a non-standard port (some hardened servers use 2222 or 8022), CtrlOps doesn't have a port field today, so port 22 is assumed. Either move SSH back to 22, or open a port-forward via the AI Terminal once you're in.
The server's identity has changed since the last time your computer talked to it. This is a security warning, not necessarily an attack.
Legitimate reasons this happens:
- The server was rebuilt or reinstalled.
- The IP got reassigned to a different machine.
- The OS was reinstalled on the same disk.
Fix on your local machine (open Terminal on Mac/Linux or PowerShell on Windows):
ssh-keygen -R <server-ip-or-hostname>Then try Connect again in CtrlOps.
Only clear the host key if you actually expected the server to change. If the IP wasn't supposed to change, investigate before clearing.
Your computer can't find a route to the server.
If you're using a hostname (like api.yoursite.com), check DNS:
dig api.yoursite.com +shortIf the IP is wrong or empty, fix the A record at your DNS provider and wait 5 to 30 minutes for propagation. No terminal handy? Our free DNS record lookup runs the same check in the browser.
If a recent DNS change isn't sticking, try with the raw IP address as a workaround.
CtrlOps only works with Linux servers. The supported list:
- Ubuntu, Debian
- CentOS, RHEL, Rocky, AlmaLinux, Fedora
- Amazon Linux
- Other mainstream Linux distributions
If you pointed at a Windows server by mistake, double-check the IP. If you genuinely need to manage Windows, that's outside CtrlOps' scope today.
You probably saved the connection without checking Remember password. Two options:
- For one server: Open the password modal next time and tick Remember password.
- Switch to key-based auth: Use the SSH Setup Wizard on the Home page to generate a key, copy the public part to
~/.ssh/authorized_keyson the server, then re-add the connection on the .pem Key-based Connection tab.
Two common causes:
- The server's IP changed. Cloud VMs with dynamic IPs lose their address on stop/start. Confirm in your provider's console, then click Edit on the connection card to update the IP.
- The key file moved or got new permissions. Confirm the path still exists, and re-run
chmod 600 yourkey.pem.
The user account on the server may have a non-interactive shell (like /usr/sbin/nologin), or the home directory is missing.
Get in through the cloud console and check:
grep <username> /etc/passwdThe shell at the end of the line should be /bin/bash or /bin/sh. If it's /bin/false or /usr/sbin/nologin, fix it:
sudo usermod -s /bin/bash <username>Your local SSH agent is offering too many keys before getting to the right one. Two fixes:
Tell SSH to only use one specific key. Open ~/.ssh/config on your computer and add:
Host my-server
HostName 1.2.3.4
User ubuntu
IdentityFile ~/.ssh/specific_key.pem
IdentitiesOnly yesOr, in CtrlOps, switch to the .pem Key-based Connection tab and pick the exact key file. CtrlOps then uses only that key.
When all else fails: gather details and ask
Before you reach out for help, collect:
| Info | Where to find it |
|---|---|
| Everything about the failure itself | Click Copy report in the Connection failed modal. It captures the server, the address dialled, the stage it failed at, the timing, the error code, and the full timeline in one paste |
| Auth method | Password, .pem key, or SSH Agent |
| Cloud provider | AWS, GCP, DigitalOcean, etc. |
Output of ssh -vvv user@ip from your local terminal | Run on your local machine to capture verbose SSH logs |
Then bring it to:
- Discord community: Join Discord
- AI Assistant inside CtrlOps, paste the copied report and ask for a translation. It's surprisingly good at decoding SSH error messages.
Always keep a fallback way into your server, your cloud provider's web console, a second user, or a different SSH key on a different machine. The day your only SSH key stops working is not the day you want to be locked out.