SSH Connection Error Troubleshooting Guide (Connection refused, Permission denied, etc.)

SSH Connection Error Troubleshooting Guide (Connection refused, Permission denied, etc.)

This guide organizes common SSH connection problems by cause. It walks through how to diagnose and fix error messages such as Connection refused, Permission denied (publickey), and Host key verification failed.

If you see kex_exchange_identification: read: Connection reset by peer immediately after connecting, check pre-auth connection limits and server logs in Diagnosing SSH reset by peer / Connection closed.

1. Connection refused — Check the SSH daemon

# SSH check
sudo systemctl status ssh        # Ubuntu/Debian
sudo systemctl status sshd       # CentOS/RHEL

# when when
sudo systemctl start ssh
sudo systemctl enable ssh

# check
sudo ss -tlnp | grep ssh

If the SSH daemon is running but you still get refused, confirm that the SSH service is using port 22. You can check the port number with the following command.

# SSH check
sudo sshd -T | grep port

2. Connection refused / timed out — Check the firewall

When SSH fails with refused or timed out, check the OS firewall settings and the cloud provider's security groups.

# UFW (Ubuntu )
sudo ufw status
sudo ufw allow ssh # 22

# firewalld (CentOS/RHEL)
sudo firewall-cmd --list-services
sudo firewall-cmd --add-service=ssh --permanent && sudo firewall-cmd --reload

# iptables check
sudo iptables -L INPUT -n | grep 22

If SSH does not work in a cloud environment, check the instance's security group settings.

curl -s ifconfig.me
# IP after IP .

3. Permission denied (publickey) — Key authentication failed

If you get Permission denied (publickey) when connecting over SSH, check the following:

1. Specify the key file path: Pass the key file path with the -i option when running the SSH command.
2. authorized_keys permissions: On the server, check and fix the owner and permissions of .ssh/authorized_keys.
3. Public key registration: Confirm that the client's public key is correctly added to ~/.ssh/authorized_keys on the server.
4. sshd_config settings: Confirm that the SSH service has key authentication enabled (PubkeyAuthentication yes).

4. Host key verification failed — Fingerprint mismatch

This can appear after a server reinstall or IP change, but also when you are connecting to a different server or in a man-in-the-middle attack. Verify the new host key fingerprint through a trusted out-of-band path such as the management console. Update the existing entry only after you confirm the change is legitimate.

ssh-keygen -R IP
# when when fingerprint path check
ssh user@IP

For the host key verification procedure, see the OpenSSH host key verification documentation.

5. Quick diagnostic checklist

Run the following commands in order to diagnose SSH connection problems.

ssh -v user@IP 2>&1 | head -30 # verbose
telnet IP 22 #
curl -v telnet://IP:22 # telnet when
nc -zv IP 22 # netcat check

# run
sudo systemctl is-active ssh #
sudo ss -tlnp | grep :22 #
sudo ufw status #
sudo tail -20 /var/log/auth.log # (Ubuntu)
sudo tail -20 /var/log/secure # (CentOS)

Summary

Frequently asked questions (FAQ)

Q. How do SSH connection refused and timed out differ? A. refused means the connection attempt received a connection-refused response. timed out means the connection did not complete within the time limit. A timeout alone does not prove that packets never reached the server. For refused, check the daemon and OS firewall; for timed out, start with the cloud security group.

Q. The daemon is running, but I still get connection refused. A. The port may not be 22 (Port in sshd_config), or the SSH service may be bound to a specific IP only (ListenAddress). On the server, check the actual listen address and port with sudo ss -tlnp | grep sshd.