SSH Troubleshooting: IDA ↔ Sozo PC

Date: 2026-05-15 Status: ✅ Resolved

Problem

IDA PC cannot SSH into Sozo PC via Tailscale IP (100.83.112.84). Connection hangs at KEX (key exchange) stage despite:

  • Port 22 is open (TCP handshake succeeds)
  • Public key is correctly stored in C:\ProgramData\ssh\administrators_authorized_keys
  • ACL permissions set correctly via icacls
  • PubkeyAuthentication yes confirmed in sshd_config

Root Cause

Tailscale relay connection instability. The DERP relay “sin” (Singapore) between IDA PC and Sozo PC enters a state where TCP handshake completes (sshd banner received) but SSH key exchange packets are not forwarded. This is resolved by restarting Tailscale client on IDA side.

Diagnostic Commands

Check if TCP port is reachable (bash)

timeout 5 bash -c 'cat < /dev/tcp/100.83.112.84/22'
# Returns "SSH-2.0-OpenSSH_for_Windows_9.5" if reachable

Check Tailscale status

tailscale status
# Look for: "active; relay 'sin', tx X rx Y"

Check SSH service on Sozo PC (from Termux)

netstat -ano | findstr ":22"
# Look for LISTENING on 0.0.0.0:22 or [::]:22

Solution Steps

1. Generate SSH key pair (on IDA PC)

ssh-keygen -t ed25519 -C "hermes-agent@IDA" -f ~/.ssh/id_ed25519_hermes -N ""

2. Add public key to Sozo PC (on Sozo PC)

echo ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFY/... hermes-agent@IDA >> /c/ProgramData/ssh/administrators_authorized_keys

3. Fix Windows ACL permissions (critical!)

cmd /c 'icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "SYSTEM:F" /grant "Administrators:F"'

4. Restart SSH service on Sozo PC

net stop sshd && net start sshd

5. If connection hangs at KEX, restart Tailscale on IDA PC

tailscale logout
tailscale up --qr
# Then re-authenticate via browser link

Key Files

FilePurpose
C:\ProgramData\ssh\administrators_authorized_keysSSH public keys for Windows admin users
C:\ProgramData\ssh\sshd_configOpenSSH server configuration
%LOCALAPPDATA%\Tailcale\logs\Tailscale client logs

Public Key (Hermes Agent - IDA PC)

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFY/A1gKrG8yNoY20+PNJ9tM22Uv6PMe+6Ku01PvMgcw hermes-agent@IDA
Fingerprint: SHA256:XZaF7OgzkAZ1z7N0AOADyEEAO6BCJHNZ7V2ozQE06SU

Windows SSH Specifics

  • Admin users must use administrators_authorized_keys (not authorized_keys in user home)
  • File must be readable by SYSTEM and Administrators group
  • Match Group administrators directive in sshd_config enables this path
  • Password-less auth confirmed working with key-based auth

New Root Cause Discovered (2026-05-16)

Problem: IDA PC SSH hangs at KEX even though:

  • TCP port 22 is open (banner SSH-2.0-OpenSSH_for_Windows_9.5 received)
  • Tailscale direct connection confirmed (direct x.x.x.x:port)
  • Key exists in administrators_authorized_keys

Root cause: Non-default SSH key filename. OpenSSH client auto-loads only:

id_rsa, id_ecdsa, id_ed25519, id_dsa, id_ecdsa_sk, id_ed25519_sk

Custom-named key id_ed25519_hermes is NOT auto-loaded → SSH client offers NO key → no auth method available → hangs at KEX.

Fix — always use explicit -i:

ssh -i ~/.ssh/id_ed25519_hermes [email protected] "hostname"

Permanent fix — copy to default name:

cp ~/.ssh/id_ed25519_hermes ~/.ssh/id_ed25519
cp ~/.ssh/id_ed25519_hermes.pub ~/.ssh/id_ed25519.pub

Note: The earlier symptom (KEX hang after Tailscale relay instability) and this symptom look identical but have different root causes:

SymptomRoot CauseFix
KEX hang + relay ‘sin’Tailscale relay unstableRestart Tailscale
KEX hang + direct connection + key not default nameSSH client can’t find keyUse -i flag