SSH Troubleshooting: IDA ↔ Sozo PC
Date: 2026-05-15 Status: ✅ Resolved
Problem
IDA PC cannot SSH into Sozo PC via Tailscale IP (100.83.112.84). Connection hangs at KEX (key exchange) stage despite:
- Port 22 is open (TCP handshake succeeds)
- Public key is correctly stored in
C:\ProgramData\ssh\administrators_authorized_keys - ACL permissions set correctly via
icacls PubkeyAuthentication yesconfirmed in sshd_config
Root Cause
Tailscale relay connection instability. The DERP relay “sin” (Singapore) between IDA PC and Sozo PC enters a state where TCP handshake completes (sshd banner received) but SSH key exchange packets are not forwarded. This is resolved by restarting Tailscale client on IDA side.
Diagnostic Commands
Check if TCP port is reachable (bash)
timeout 5 bash -c 'cat < /dev/tcp/100.83.112.84/22'
# Returns "SSH-2.0-OpenSSH_for_Windows_9.5" if reachableCheck Tailscale status
tailscale status
# Look for: "active; relay 'sin', tx X rx Y"Check SSH service on Sozo PC (from Termux)
netstat -ano | findstr ":22"
# Look for LISTENING on 0.0.0.0:22 or [::]:22Solution Steps
1. Generate SSH key pair (on IDA PC)
ssh-keygen -t ed25519 -C "hermes-agent@IDA" -f ~/.ssh/id_ed25519_hermes -N ""2. Add public key to Sozo PC (on Sozo PC)
echo ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFY/... hermes-agent@IDA >> /c/ProgramData/ssh/administrators_authorized_keys3. Fix Windows ACL permissions (critical!)
cmd /c 'icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "SYSTEM:F" /grant "Administrators:F"'4. Restart SSH service on Sozo PC
net stop sshd && net start sshd5. If connection hangs at KEX, restart Tailscale on IDA PC
tailscale logout
tailscale up --qr
# Then re-authenticate via browser linkKey Files
| File | Purpose |
|---|---|
C:\ProgramData\ssh\administrators_authorized_keys | SSH public keys for Windows admin users |
C:\ProgramData\ssh\sshd_config | OpenSSH server configuration |
%LOCALAPPDATA%\Tailcale\logs\ | Tailscale client logs |
Public Key (Hermes Agent - IDA PC)
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFY/A1gKrG8yNoY20+PNJ9tM22Uv6PMe+6Ku01PvMgcw hermes-agent@IDA
Fingerprint: SHA256:XZaF7OgzkAZ1z7N0AOADyEEAO6BCJHNZ7V2ozQE06SU
Windows SSH Specifics
- Admin users must use
administrators_authorized_keys(notauthorized_keysin user home) - File must be readable by
SYSTEMandAdministratorsgroup Match Group administratorsdirective in sshd_config enables this path- Password-less auth confirmed working with key-based auth
New Root Cause Discovered (2026-05-16)
Problem: IDA PC SSH hangs at KEX even though:
- TCP port 22 is open (banner
SSH-2.0-OpenSSH_for_Windows_9.5received) - Tailscale direct connection confirmed (
direct x.x.x.x:port) - Key exists in
administrators_authorized_keys
Root cause: Non-default SSH key filename. OpenSSH client auto-loads only:
id_rsa, id_ecdsa, id_ed25519, id_dsa, id_ecdsa_sk, id_ed25519_sk
Custom-named key id_ed25519_hermes is NOT auto-loaded → SSH client offers NO key → no auth method available → hangs at KEX.
Fix — always use explicit -i:
ssh -i ~/.ssh/id_ed25519_hermes [email protected] "hostname"Permanent fix — copy to default name:
cp ~/.ssh/id_ed25519_hermes ~/.ssh/id_ed25519
cp ~/.ssh/id_ed25519_hermes.pub ~/.ssh/id_ed25519.pubNote: The earlier symptom (KEX hang after Tailscale relay instability) and this symptom look identical but have different root causes:
| Symptom | Root Cause | Fix |
|---|---|---|
| KEX hang + relay ‘sin’ | Tailscale relay unstable | Restart Tailscale |
| KEX hang + direct connection + key not default name | SSH client can’t find key | Use -i flag |