Systematically diagnose a failing ssh connection or authentication attempt using client-side verbosity flags and server-side sshd log/debug output, and fix the most common causes (key permissions, wrong identity offered, host-side StrictModes).

Documented steps

1. Reproduce with increasing client verbosity: ssh -v <user>@<host>, then -vv, then -vvv (3 is the maximum). Each level shows more: key exchange/algorithm negotiation, which identity files and agent keys were offered, and errors that prevented public key authentication from succeeding.
2. See exactly which keys ssh would try, in order, before connecting: ssh -Z <user>@<host> lists the public keys that would be attempted for authentication to that destination, in preferred order, and exits without connecting.
3. If ssh-agent holds many keys, the server may hit its authentication-attempt limit before your intended key is tried. Force a single specific key: ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 -v <user>@<host>. Per ssh_config(5), IdentitiesOnly=yes makes ssh use only the configured identity/certificate files even if ssh-agent offers more identities.
4. Check client-side file permissions, since bad ones fail silently rather than erroring loudly: chmod 700 ~/.ssh; chmod 600 ~/.ssh/id_ed25519. Per ssh(1), ssh will simply ignore a private key file if it is accessible by others -- verify with `ls -ld ~/.ssh ~/.ssh/id_ed25519`.
5. If you control the server, get sshd's own debug view by running a second instance in the foreground on a spare port: sudo sshd -d -p <test_port> (single connection, verbose to stderr; repeat -d up to 3 times for more detail), then from the client: ssh -p <test_port> -v <user>@<host>. Compare against the normal service's logs, which sshd writes via syslog (default SyslogFacility=AUTH, default LogLevel=INFO -- raise LogLevel to DEBUG in sshd_config for permission-refusal detail).
6. Check server-side prerequisites for pubkey auth to be accepted at all: home directory, ~/.ssh (700), and ~/.ssh/authorized_keys (600) must not be group/world-writable, because sshd's StrictModes (default yes) silently refuses to use authorized_keys otherwise.