Victor's room

Overview & Root Cause Summary: The network error ssh: connect to host <hostname> port 22: Connection refused indicates that the client reached the destination IP address, but the remote host’s operating system actively rejected the TCP handshake on port 22 because the SSH daemon (sshd) is inactive, listening on an alternative custom port, or blocked by a local firewall.

Understanding the Root Causes

• SSH Daemon Inactive or Crashed: The sshd service on the remote server is stopped, disabled, or failed to start after a reboot or configuration error.
• Firewall Blocking Port 22: Host firewalls (such as ufw, firewalld, or iptables) or cloud provider Security Groups (AWS/GCP/Azure) drop or reject incoming traffic on TCP port 22.
• Non-Standard SSH Port Configuration: The server’s /etc/ssh/sshd_config was hardened to listen on a custom port (e.g., 2222, 2200), but the client attempted a connection over default port 22.
• Restricted ListenAddress Binding: sshd is bound strictly to local loopback (127.0.0.1) rather than all network interfaces (0.0.0.0).

Step 1: Quick Fix (Verify and Start Remote SSH Daemon)

If you have console, VNC, or local terminal access to the target machine, verify that the SSH service is running.

# Check SSH service status on Ubuntu/Debian:
sudo systemctl status ssh

# On CentOS/RHEL/Fedora/Arch:
sudo systemctl status sshd

# Start and enable the SSH service on boot:
sudo systemctl enable --now ssh
# Or for RHEL/CentOS:
sudo systemctl enable --now sshd

# Verify that sshd is actively listening on TCP ports:
sudo ss -tulpn | grep sshd
# Or using netstat/lsof:
sudo lsof -i :22

Step 2: Check and Adjust Firewall Rules (UFW / Firewalld)

Allow inbound TCP traffic on the SSH port across your server’s active firewall.

# For UFW (Ubuntu/Debian):
sudo ufw status
sudo ufw allow 22/tcp
sudo ufw reload

# For Firewalld (CentOS/RHEL/Fedora):
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

# For Cloud Virtual Machines (AWS EC2, GCP Compute, Azure VM):
# Ensure your Security Group / Inbound VPC rules allow TCP port 22 from your client public IP.

Step 3: Verify sshd_config Port and ListenAddress Directives

Inspect the SSH server configuration file to ensure the correct listening port and network interface bindings.

# Open the SSH daemon configuration file:
sudo nano /etc/ssh/sshd_config

# Ensure the following lines are properly configured:
Port 22
ListenAddress 0.0.0.0
ListenAddress ::

# Test SSH daemon configuration syntax before restarting:
sudo sshd -t

# Restart SSH service to apply changes:
sudo systemctl restart ssh || sudo systemctl restart sshd

Verification & Testing Steps

Diagnose connectivity from your local client machine using verbose logging and port probing tools.

# 1. Test port reachability using netcat / telnet:
nc -zv <remote_host_ip> 22

# 2. Connect with verbose diagnostic output to pinpoint handshake failure:
ssh -vvv user@<remote_host_ip>

# 3. If using a non-standard custom port (e.g., 2222):
ssh -p 2222 user@<remote_host_ip>

Summary Comparison Table