Knowledgebase

SSH error messages are short and cryptic, but each one points to a specific cause. This guide explains how to fix "Permission denied (publickey)" and the other SSH connection errors you're most likely to see when connecting to your Instant Access Internet Services hosting account -- timeouts, refused connections, host key warnings, key permission errors and PuTTY's "Server refused our key".

First: get the basics right

Most SSH problems come down to one of these four settings. Check them before anything else:

Also make sure your account has shell access. If Advanced > Terminal isn't in cPanel, or it opens but SSH from your computer is refused with correct details, open a ticket and ask for shell access to be checked.

Get more detail with verbose mode

When an error isn't obvious, add -v to see each step of the connection:

ssh -v username@example.com

The lines that matter most:

• Connecting to example.com [x.x.x.x] port 22 followed by Connection established -- the network path is fine.
• Offering public key: /Users/you/.ssh/id_ed25519 -- SSH found your key and tried it.
• Server accepts key -- the key is authorized on the server.
• Authentications that can continue: publickey,password -- the server rejected what was offered so far and is waiting for another method.

Use -vvv for even more detail. If you open a ticket, paste this output (it contains no passwords or private keys).

"Permission denied (publickey)" or "Permission denied (publickey,password)"

This means the server is running and reachable, but it didn't accept any of the ways you tried to log in. Work through these in order:

1. Check the username. ssh admin@example.com or ssh you@example.com@example.com won't work. Use ssh cpanelusername@example.com.
2. Check the key is authorized. In cPanel, go to Security > SSH Access > Manage SSH Keys. Under Public Keys, your key's status must say authorized. If it says not authorized, click Manage and then Authorize.
3. Check SSH is using the right key. In the -v output, look for Offering public key. If your key isn't listed, SSH can't find it -- usually because it has a non-default name. Point to it directly:

   ssh -i ~/.ssh/id_ed25519_hosting username@example.com

4. Check the public key in cPanel matches your private key. On your computer, print the fingerprint of your key with ssh-keygen -lf ~/.ssh/id_ed25519.pub. In cPanel, click View/Download next to the public key and compare the key text with your .pub file. If they're different, import the right one.
5. Check permissions on the server. SSH ignores your authorized keys if the files can be changed by other users. Open Advanced > Terminal in cPanel and run:

   chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys

   Don't change the permissions of your home folder itself. If you think it has been changed, open a ticket.
6. Using a password? Type your current cPanel password carefully. If you changed it recently in cPanel or the client area, the new one applies to SSH too.

Stop after two or three failed attempts. Repeated failures can get your IP address blocked (see the timeout section below), which turns a simple password problem into a bigger one.

"Permission denied, please try again."

This appears after a wrong password. The server lets you try again a few times, then disconnects. Reset the password in cPanel under Preferences > Password & Security (or from the client area if you can't get into cPanel), then try once more. Better still, switch to an SSH key so there's no password to mistype.

"Connection timed out" or "Operation timed out"

Your computer sent a request and never heard back. The server didn't refuse you -- something in between dropped the traffic.

• Your IP address may be blocked. The server runs Imunify360, which can block an IP address after repeated failed logins to SSH, cPanel, email or FTP. A blocked IP usually can't reach anything on the server, so your website and email may time out too from that network. Don't keep retrying. Find your IP at whatismyipaddress.com and open a ticket with it.
• Your network may block SSH. Some workplaces, hotels, schools and public Wi-Fi networks block outgoing port 22. Try from another network, such as your phone's hotspot. If it works there, the block is on the first network.
• Check the host name resolves to us. If your domain is on Cloudflare with the proxy (orange cloud) turned on, SSH to the domain won't reach our server. Use secure.instantaccess.net as the host instead.

While you sort out a timeout, you can still use Advanced > Terminal in cPanel, which runs in your browser.

"Connection refused"

Something answered and said no. Check that you're using port 22 and not a port copied from an old guide or another host (ssh -p 2222 ... will be refused). Check the host name is spelled correctly. If port 22 is refused from every network you try, open a ticket.

"kex_exchange_identification: Connection closed by remote host" or "Connection reset by peer"

The connection opened and was immediately closed. This is usually the firewall rejecting your IP address, or occasionally a VPN or security software on your side interfering. Turn off any VPN and try again. If it continues, open a ticket with your IP address.

"Could not resolve hostname example.com"

Your computer couldn't look up the domain. Check the spelling, and make sure there's no https:// or trailing slash in the host. If your domain is new or was just moved to us, DNS may not have finished updating -- connect to secure.instantaccess.net in the meantime.

"WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!"

Your computer remembers the server's fingerprint from your first connection. This warning means the server now presents a different one. That can happen for harmless reasons -- your domain was moved to a different server, or you previously pointed the domain at another host -- but it's also exactly what an interception attack would look like, which is why SSH stops.

1. If you know the domain recently moved, or you're not sure, open a ticket and we can confirm the server's current fingerprint.
2. Once you're satisfied it's legitimate, remove the old entry from your computer:

   ssh-keygen -R example.com

3. Connect again and accept the new fingerprint when asked.

The similar message Host key verification failed means the same thing, or that you answered no to the fingerprint question. Connect again and type yes in full.

"UNPROTECTED PRIVATE KEY FILE!" / "bad permissions"

SSH won't use a private key that other people on your computer could read.

Mac and Linux:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519

Windows (PowerShell): this usually happens after copying a key from another computer or a USB stick. Remove inherited permissions and give only your own account read access:

icacls "$env:USERPROFILE\.ssh\id_ed25519" /inheritance:r
icacls "$env:USERPROFILE\.ssh\id_ed25519" /grant:r "$($env:USERNAME):(R)"

"Too many authentication failures"

If you have several keys loaded in your SSH agent, SSH offers them one after another and the server gives up before reaching the right one. Tell SSH to use only the key you name:

ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 username@example.com

To make this permanent, add IdentitiesOnly yes and IdentityFile to a Host entry in your ~/.ssh/config file (our guide to creating an SSH key shows an example).

"Enter passphrase for key" keeps rejecting you

The passphrase is the one you chose when you created the key on your computer. It isn't your cPanel password. If you can't remember it, it can't be recovered -- create a new key, import and authorize it in cPanel, and delete the old one.

"no matching key exchange method found" or "no matching host key type found"

Your SSH program is too old to speak the secure methods the server uses. Update it: install current Windows updates, update PuTTY or WinSCP to the latest version from the official site, or update the OpenSSH package on Linux. Don't use options that switch on old, weak algorithms.

PuTTY errors

"Server refused our key"

PuTTY offered your .ppk key and the server didn't accept it. The public half isn't authorized for that username. In PuTTYgen, load your .ppk, copy the text from Public key for pasting into OpenSSH authorized_keys file, and import it in cPanel under Manage SSH Keys > Import Key. Then click Manage > Authorize. Also check Connection > Data > Auto-login username is your cPanel username.

"No supported authentication methods available"

PuTTY ran out of ways to log in. Usually the key was refused and PuTTY wasn't set to fall back to a password. Fix the key as above, or clear the private key field to log in with your cPanel password.

"Unable to use key file (OpenSSH SSH-2 private key)"

PuTTY needs keys in its own format. Open the key in PuTTYgen, click Save private key, and point PuTTY at the new .ppk file.

You log in, then get thrown straight out

"This account is currently not available."

Your password or key worked, but the account doesn't have a login shell. Open a ticket and ask for shell access.

"-bash: fork: retry: Resource temporarily unavailable"

Your account has reached its limit on running processes, often because of stuck cron jobs or scripts. Check Metrics > Resource Usage in cPanel. If you can get a prompt, ps ux lists your processes and kill PID stops one. If you can't, wait a few minutes and try again, or open a ticket.

Common questions

Can I log in with an FTP account over SSH?

No. FTP accounts you create in cPanel only work with FTP and FTPS. SSH and SFTP use your main cPanel username.

How do I know if my IP address is blocked?

The typical sign is that everything on the server -- SSH, your website, webmail, cPanel -- times out from one network but works from another (for example your phone on mobile data). Open a ticket with your IP address and we'll check.

Is it safe to post my -v output in a ticket?

Yes. Verbose output shows file names, key fingerprints and the steps of the connection, not your password or private key. Never paste the contents of your private key file.

Terminal in cPanel works but SSH from my computer doesn't. Why?

Terminal runs inside cPanel, so it doesn't depend on your network, your SSH program or your keys. If Terminal works, the account is fine and the problem is on the connection side: the IP block, network, host name, username or key.

Related guides

• How to Use SSH, SSH Keys and Terminal in cPanel
• ERR_CONNECTION_TIMED_OUT and ERR_CONNECTION_REFUSED: How to Fix Them
• How to Change Your cPanel Password
• cPanel Resource Usage Explained: CPU, Memory and Entry Process Limits
• How to Open a Support Ticket That Gets Solved Fast

Still stuck? Open a support ticket and the Instant Access Internet Services team will help.