Linux SSH Connection Failed? Troubleshooting Connection Refused, Timeouts and Login Errors

Losing SSH access is one of the most common server problems. This guide gives you a step-by-step Linux SSH troubleshooting process to quickly tell whether the network, the port, the sshd service, the firewall or a fail2ban ban is to blame, and how to get in through the VNC console when SSH is completely unavailable. It applies to VPS and dedicated servers running Debian/Ubuntu or CentOS/Rocky/AlmaLinux.

Step 1: Read the SSH Error to Narrow Down the Cause

Each error points in a different direction, so read it carefully first:

• Connection refused: the server is reachable but nothing listens on that port — sshd is stopped or the port is wrong.
• Connection timed out: no reply at all — wrong IP, server down, firewall dropping packets or your IP is banned.
• Permission denied: network and service are fine; the username, password or key is the problem.
• Connection reset / closed by remote host: often fail2ban, hosts.deny or a broken sshd configuration.

ssh: connect to host 203.0.113.10 port 22: Connection refused
ssh: connect to host 203.0.113.10 port 22: Connection timed out
[email protected]: Permission denied (publickey,password).
kex_exchange_identification: read: Connection reset by peer

Step 2: Test SSH Port Connectivity from Your Computer

Check whether the port is reachable and use ssh -vvv to see the handshake in detail. If it works from a different network such as a phone hotspot, the problem is your local network or ISP, not the server.

# Windows PowerShell
Test-NetConnection 203.0.113.10 -Port 22

# macOS / Linux
nc -vz -w 5 203.0.113.10 22

# Verbose SSH client output shows where it fails
ssh -vvv -p 22 [email protected]

Step 3: Log In Through the VNC Console

When SSH is down, go to the client area → My Products & Services → select the server → Manage and open the VNC console (the label may vary by product; open a ticket if you cannot find it). VNC is like plugging in a monitor and keyboard: it does not depend on SSH or the network configuration. Log in as root with your password and run the following checks there.

# In the VNC console
localhost login: root
Password:
# Then confirm the network is up
ip a
ping -c 3 1.1.1.1

Step 4: Check the sshd Service and Listening Port

Make sure sshd is running. If it shows failed, run sshd -t to find syntax errors, fix them and restart. Then use ss to confirm the port it actually listens on matches the one you are connecting to.

# Debian / Ubuntu (service name: ssh)
systemctl status ssh
# CentOS / Rocky / AlmaLinux (service name: sshd)
systemctl status sshd

sshd -t                       # config syntax check
systemctl restart sshd        # or: systemctl restart ssh

ss -tlnp | grep sshd
# LISTEN 0 128 0.0.0.0:22  0.0.0.0:*  users:(("sshd",pid=812,fd=3))

Step 5: Make Sure the Firewall Allows the SSH Port

Check the rules of whichever firewall your system uses and confirm the SSH port (22 or your custom port) is allowed. Changing the SSH port and forgetting to open it is the most common cause of timeouts.

# firewalld (CentOS / Rocky / AlmaLinux)
firewall-cmd --list-all
firewall-cmd --permanent --add-service=ssh && firewall-cmd --reload

# ufw (Debian / Ubuntu)
ufw status verbose
ufw allow 22/tcp

# Raw rules (iptables / nftables)
iptables -S | head -n 30
nft list ruleset | head -n 50

Step 6: Check Whether fail2ban Banned Your IP

After repeated failed logins, fail2ban automatically bans the source IP, which shows up as sudden timeouts or refusals. Look up your public IP on a "what is my IP" website, then check and unban it on the server.

fail2ban-client status sshd
fail2ban-client set sshd unbanip 198.51.100.25

# Also check TCP wrappers on older systems
cat /etc/hosts.deny

Step 7: Read the SSH Logs

If everything above looks fine, the sshd logs usually state the exact reason — bad permissions, a user not allowed to log in, an invalid key format and so on. A full disk can also break logins.

# Recent sshd logs
journalctl -u sshd -n 50 --no-pager      # CentOS / Rocky / AlmaLinux
journalctl -u ssh -n 50 --no-pager       # Debian / Ubuntu
tail -n 50 /var/log/secure               # RHEL family
tail -n 50 /var/log/auth.log             # Debian / Ubuntu

# A full disk can also break logins
df -h /

FAQ

After reinstalling the OS, SSH complains the host key changed.

Your computer still has the old fingerprint. Run ssh-keygen -R server-IP locally to remove it, then connect again.

Only my network cannot connect; others can.

Your IP may be banned by fail2ban, or your network blocks the port. Try another network, or unban your IP or switch to another port via VNC.

I forgot the root password needed for VNC.

Reset it from the client area if your product supports it, or boot into single-user mode via VNC to reset it. Open a ticket if you are not comfortable doing this.

Still stuck after following these steps? Open a support ticket and the IMIDC 24/7 technical team will help. Please include the server IP, operating system, the commands you ran and a screenshot of the error so we can pinpoint the issue faster.