Debug SSH at the Maximum Verbosity Level

alias sshv='ssh -vvv -o LogLevel=DEBUG3'

When debugging an ssh connection either to optimize your settings ie compression, ciphers, or more commonly for debugging an issue connecting, this alias comes in real handy as it's not easy to remember the '-o LogLevel=DEBUG3' argument, which adds a boost of debugging info not available with -vvv alone. Especially useful are the FD info, and the setup negotiation to create a cleaner, faster connection.

Sample Output

OpenSSH_5.6p1, OpenSSL 1.0.0a 1 Jun 2010
debug1: Reading configuration data /home/askapache/.ssh/config
debug1: Applying options for askapacheweb
debug1: Reading configuration data /etc/ssh/ssh_config
debug3: cipher ok: blowfish-cbc [blowfish-cbc,aes128-cbc,3des-cbc,cast128-cbc,aes128-ctr,arcfour128]
debug3: cipher ok: aes128-cbc [blowfish-cbc,aes128-cbc,3des-cbc,cast128-cbc,aes128-ctr,arcfour128]
debug3: cipher ok: 3des-cbc [blowfish-cbc,aes128-cbc,3des-cbc,cast128-cbc,aes128-ctr,arcfour128]
debug3: cipher ok: cast128-cbc [blowfish-cbc,aes128-cbc,3des-cbc,cast128-cbc,aes128-ctr,arcfour128]
debug3: cipher ok: aes128-ctr [blowfish-cbc,aes128-cbc,3des-cbc,cast128-cbc,aes128-ctr,arcfour128]
debug3: cipher ok: arcfour128 [blowfish-cbc,aes128-cbc,3des-cbc,cast128-cbc,aes128-ctr,arcfour128]
debug3: ciphers ok: [blowfish-cbc,aes128-cbc,3des-cbc,cast128-cbc,aes128-ctr,arcfour128]
debug3: key names ok: [ssh-rsa]
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to www.askapache.com [208.86.158.195] port 25627.
debug1: Connection established.
debug3: Not a RSA1 key file /home/askapache/.ssh/key.rsa5.
debug1: identity file /home/askapache/.ssh/key.rsa5 type -1
debug1: identity file /home/askapache/.ssh/key.rsa5-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_4.3
debug1: match: OpenSSH_4.3 pat OpenSSH_4*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.6
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(4096<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 147/256
debug2: bits set: 488/4096
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: put_host_port: [208.86.158.195]:25627
debug3: put_host_port: [www.askapache.com]:25627
debug3: check_host_in_hostfile: host [www.askapache.com]:25627 filename /home/askapache/.ssh/known_hosts
debug3: check_host_in_hostfile: host [www.askapache.com]:25627 filename /home/askapache/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 7
debug3: check_host_in_hostfile: host [208.86.158.195]:25627 filename /home/askapache/.ssh/known_hosts
debug3: check_host_in_hostfile: host [208.86.158.195]:25627 filename /home/askapache/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 8
debug1: Host '[www.askapache.com]:25627' is known and matches the RSA host key.
debug1: Found key in /home/askapache/.ssh/known_hosts:7
debug2: bits set: 484/4096
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/askapache/.ssh/key.rsa5 ((nil))
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug3: start over, passed a different list publickey,password,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/askapache/.ssh/key.rsa5
debug1: read PEM private key done: type RSA
debug3: sign_and_send_pubkey: RSA 44:bf:40:5e:gg:33:f4:77
debug2: we sent a publickey packet, wait for reply
debug1: Authentication succeeded (publickey).
Authenticated to www.askapache.com ([208.86.158.195]:25627).
debug2: fd 5 setting O_NONBLOCK
debug3: fd 6 is O_NONBLOCK
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug1: Entering interactive session.
debug2: callback start
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 1
debug2: channel 0: request shell confirm 1
debug2: fd 3 setting TCP_NODELAY
debug2: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug2: channel_input_status_confirm: type 99 id 0
debug2: PTY allocation request accepted on channel 0
debug2: channel 0: rcvd adjust 2097152
debug2: channel_input_status_confirm: type 99 id 0
debug2: shell request accepted on channel 0

$ exit

debug2: channel 0: rcvd eof
debug2: channel 0: output open -> drain
debug2: channel 0: obuf empty
debug2: channel 0: close_write
debug2: channel 0: output drain -> closed
debug2: channel 0: rcvd close
debug2: channel 0: close_read
debug2: channel 0: input open -> closed
debug3: channel 0: will not send data after close
debug2: channel 0: almost dead
debug2: channel 0: gc: notify user
debug2: channel 0: gc: user detached
debug2: channel 0: send close
debug2: channel 0: is dead
debug2: channel 0: garbage collecting
debug1: channel 0: free: client-session, nchannels 1
debug3: channel 0: status: The following connections are open:
  #0 client-session (t4 r0 i3/0 o3/0 fd -1/-1 cc -1)
debug3: channel 0: close_fds r -1 w -1 e 6
Connection to www.askapache.com closed.
Transferred: sent 2528, received 7200 bytes, in 7.6 seconds
Bytes per second: sent 334.7, received 953.2
debug1: Exit status 0

By: AskApache

2010-10-30 11:23:52

alias ssh bash alias log Encryption debug tty askapache SSH_TTY logging loglevel

Submit An Alternative

What Others Think

rahimhh21 · 86 weeks and 2 days ago

Perfecthomepugs · 77 weeks and 2 days ago

pugpuppies95 · 39 weeks and 3 days ago

Thank you for sharing your personal experiences and insights. It makes your blog relatable and enjoyable to read. Thanks! Baroque,Potato,Button pearls wholesaler

onenaturalpearl · 17 weeks and 4 days ago

What do you think?

Any thoughts on this command? Does it work on your machine? Can you do the same thing with only 14 characters?

You must be signed in to comment.

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands

Similar Commands

Turn shell tracing and verbosity (set -xv) on/off with 1 command!

put all lines in comment where de word DEBUG is found

uncomment the lines where the word DEBUG is found

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:

» all commands
» commands with 3 up-votes (commandlinefu3)
» commands with 10 up-votes (commandlinefu10)