Control works, but SSH fails

Troubleshoot SSH sessions after an agent has registered

If the agent is visible in tealc list but tealc ssh AGENT_NAME fails, the control path is working and the problem is probably in the data path.

Check:

  • the agent’s SSH service is enabled;
  • the server SSH listener or ssh-websocket endpoint is enabled;
  • the client is using the intended --ssh-server or --ws mode;
  • the agent’s SSH port matches the server configuration; and
  • the operator IP is allowed by allowed-ips.

Run the client with verbose logging:

tealc --verbose ssh AGENT_NAME

Expected output when the SSH data path is healthy:

TODO_PLACEHOLDER_HERE

For an HTTP-only path, confirm that the server has ssh-websocket: true and use:

tealc --ws ssh AGENT_NAME

If SSH opens but a particular feature fails, test that feature separately: file transfers, forwards, or proxies.