Read SSH logs and failures

The operator distinguishes timeout, host-key failure, rejected key, invalid account, file-mode rejection, and shell startup failure. This is a small part of a safe operator path from a local machine to a disposable Ubuntu server, including file transfer, tunnels, automation, and recovery, but the boundary it creates affects everything that follows.

Client and server logs describe different sides of negotiation, key selection, policy, permissions, and session startup. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

Watch for one shortcut in particular: trying to regenerate keys immediately whenever login fails. It makes later failures harder to locate. Instead, locate the failure layer first, compare both sides, and change only the setting supported by evidence. Prefer an implementation you can explain from the outside before optimizing it.

Keep the wider goal in view: Reduce SSH exposure on the server while preserving a tested recovery path before removing existing access. A short observation with concrete evidence is more useful than a confident sentence with no reproduction path.

Create four controlled failures and write a diagnosis from logs before applying any fix. Hand the result to someone else and see whether the behavior is clear without an oral explanation.