SSH errors

• Host key verification failed.SSH couldn't confirm the server's identity — the host isn't in known_hosts and SSH can't ask you (non-interactive/CI or StrictHostKeyChecking=yes), or the stored key doesn't match.
• kex_exchange_identification: Connection closed by remote hostThe TCP connection opened, but the server closed it before even sending its SSH banner. Typical causes are sshd rate limiting (MaxStartups), fail2ban/firewall blocks, TCP wrappers, a broken sshd, or a proxy/VPN that isn't really SSH on that port.
• Load key "id_rsa": invalid formatOpenSSH couldn't parse the private key file. It is usually damaged (missing newline, Windows line endings, copied with spaces from a CI variable), it is a public key or a PuTTY .ppk file, or the wrong file is passed with -i.
• no matching host key type found. Their offer: ssh-rsaOpenSSH 8.8+ disables the old SHA-1 `ssh-rsa` signature algorithm, and the server (old router, NAS, legacy Linux, old Gerrit/Bitbucket) only offers that. Enable it just for that host, or upgrade the server's SSH.
• Permission denied (publickey)The server only accepts key authentication and rejected every key you offered. Check the key, the username, file permissions and authorized_keys.
• Received disconnect: Too many authentication failuresYour SSH client offered more keys than the server's MaxAuthTries allows (default 6) before reaching the right one or password auth. Usually ssh-agent holds many keys and tries them all.
• ssh: connect to host port 22: Connection refusedThe machine was reached, but nothing accepted the connection on port 22 — sshd isn't running, isn't installed, listens on another port or address, or a firewall actively rejects the connection.
• ssh: connect to host port 22: Connection timed outYour SSH packets never got an answer. A firewall (cloud security group, ufw, corporate network) is dropping port 22, the server is down or has a different IP, or SSH listens on another port.
• WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!The server's host key differs from the one saved in known_hosts. If you know why (reinstalled server, new IP owner), remove the old key with ssh-keygen -R.
• WARNING: UNPROTECTED PRIVATE KEY FILE!SSH refuses to use a private key that other users can read. Restrict it with chmod 600 (or 400).