diff --git a/dvc/remote/ssh/__init__.py b/dvc/remote/ssh/__init__.py
index 75a2a6f98..572f7d7de 100644
--- a/dvc/remote/ssh/__init__.py
+++ b/dvc/remote/ssh/__init__.py
@@ -115,9 +115,10 @@ class RemoteSSH(RemoteBASE):
             return identity_file[0]
         return None
 
-    def ssh(self, path_info):
+    def ensure_credentials(self, path_info=None):
+        if path_info is None:
+            path_info = self.path_info
         host, user, port = path_info.host, path_info.user, path_info.port
-
         # NOTE: we use the same password regardless of the server :(
         if self.ask_password and self.password is None:
             with saved_passwords_lock:
@@ -133,13 +134,16 @@ class RemoteSSH(RemoteBASE):
                     )
                 self.password = password
 
+    def ssh(self, path_info):
+        self.ensure_credentials(path_info)
+
         from .connection import SSHConnection
 
         return get_connection(
             SSHConnection,
-            host,
-            username=user,
-            port=port,
+            path_info.host,
+            username=path_info.user,
+            port=path_info.port,
             key_filename=self.keyfile,
             timeout=self.timeout,
             password=self.password,
@@ -306,6 +310,9 @@ class RemoteSSH(RemoteBASE):
         if not self.no_traverse:
             return list(set(checksums) & set(self.all()))
 
+        # possibly prompt for credentials before "Querying" progress output
+        self.ensure_credentials()
+
         with Tqdm(
             desc="Querying "
             + ("cache in " + name if name else "remote cache"),