How to Fix the SSH Connection Refused Error (5 Troubleshooting Methods)

1. What Is SSH
2. What Causes SSH “Connection Refused” Error & Its Solutions?
   1. SSH Client Not Installed on Your Local Machine
   2. SSH Daemon Not Installed or Running on the Remote Server
   3. Firewall Blocking SSH Connections
   4. Incorrect SSH Credentials or Port Configuration
   5. “SSH Service Not Running or Needs Restarting
   6. “SSH Access Has Been Disabled
   7. “SSH Port Is Closed
3. Additional Tips and Best Practices for SSH Troubleshooting
4. Troubleshooting the SSH “Connection Refused” Error

What Is SSH, and When Should You Use It?

SSH (Secure Shell) is a secure way to connect to your website’s server remotely. It allows you to access and manage your server using a command-line interface, even over an unsecured network.

Unlike FTP, which only lets you upload, edit, or delete files, SSH gives you direct control over your server. This makes it essential for developers and site administrators who need to troubleshoot issues, run commands, or automate tasks.

Here are some key tools that work with SSH:

• WP-CLI – The WordPress command-line interface. It helps with tasks like installing WordPress, updating plugins in bulk, and managing media files.
• Composer– A PHP package manager that pulls in the necessary frameworks and dependencies for your site’s code.
• Git– A version control system that tracks code changes. Useful for teams working on the same project.
• npm– A JavaScript package manager that includes a command-line tool and a software registry.

While SSH is powerful, it does require some technical knowledge. If you’re managing a basic WordPress site, you may not need it. However, for developers and advanced users, SSH provides the flexibility and control necessary for efficient site management.

What Causes SSH “Connection Refused” Error & Its Solutions?

SSH “Connection Refused” Error is displayed when a user cannot connect to an SSH server. It occurs when the server is not accepting connections or there is a problem with the network connection between the client and the server.

To understand the root cause of this error, let’s explore some potential causes and their solutions:

1. Cause: SSH Client Not Installed on Your Local Machine

To establish an SSH connection using PuTTY or similar programs, you need two components: an SSH client on your local machine and an SSH daemon running on the remote server. The SSH client initiates the connection, while the SSH daemon listens for incoming connection requests and authenticates them.

In most cases, servers, especially managed WordPress hosts, come pre-installed with the necessary daemon program. However, if you are utilizing a dedicated host, you may need to install the daemon manually.

Having the daemon program installed ensures that the server can accept SSH connections, allowing you to establish a secure and authenticated connection to your server.

Solution: Install SSH Client

You can perform a quick check in the terminal window to determine if the SSH client is installed on your system.

Simply type “ssh” and hit Enter.

If the terminal displays a list of available ssh command options, it indicates that the SSH client has already been installed on your system. This is true in my case:

However, if the response is “command not found,” the SSH client is not installed, and you will need to install the OpenSSH Client to enable SSH functionality.

To install the SSH Client on your machine, follow these steps:

• Open the terminal on your system.
• Depending on your operating system, execute one of the following commands:

For Ubuntu/Debian systems:

sudo apt install openssh-client

For CentOS/RHEL systems:

sudo yum install openssh-client

If you are a Cloudways user, enabling SSH access is a straightforward process through the Cloudways platform. Follow these steps to enable SSH access:

• Log in to the Cloudways Platform using your email address and password.
• From the top menu bar, select Servers.
• Choose the server where your desired application is hosted.
  
• Select the www option.
• Locate your desired application’s name and click on it.
  
• Under Application Management, navigate to Application Settings.
  
• Look for the Enable SSH Access option and toggle it on.
  
• When prompted to confirm enabling SSH access, click OK.
  
• With SSH access enabled, all the Application Credentials defined for that specific application will have SSH access in addition to the default SFTP access.

2. Cause: SSH Daemon Not Installed or Running on the Remote Server

If the SSH daemon is unavailable or not running, it can result in blocking incoming connections to the SSH local host.

Solution: Install SSH Daemon Package Manually

Most web hosting companies typically include a pre-installed SSH daemon on their servers. However, if the SSH daemon’s status is reported as Down, you should contact your hosting provider to address this issue.

To check the status of the SSH daemon, use one of the following commands depending on your system:

sudo service ssh status

or

sudo systemctl status sshd

or

systemctl status ssh

If you see active (running), like in the screenshot above, this means that the service is active. If you’re a Cloudways user, keep in mind that Cloudways restricts direct root access for security.

So to check if the SSH daemon service is active, run this command to see if the SSH process is active:

ps aux | grep sshd

If SSH is running, you’ll see an output with lines containing sshd. If not, SSH may be down.

When managing a dedicated server or local host, manually installing the SSH daemon package becomes necessary.

Installing the OpenSSH client and server applications is a simple process. To install the OpenSSH server application and related support files, execute the following command in the terminal:

sudo apt install openssh-server

By executing this command, you can install the required components to ensure the proper functioning of the SSH daemon and establish successful SSH connections.

3. Cause: Firewall Blocking SSH Connections

If you are experiencing an “SSH Connection refused” error, your server’s firewall is likely blocking incoming SSH connections. To resolve this issue, you must apply specific firewall rules allowing SSH connection requests.

Solution: Allow SSH Connections Through the Firewall

To check if the firewall is blocking the SSH port, use the following command:

sudo ufw status

This command will display the current firewall rules. Look for the SSH port (default is 22) in the list of allowed ports. If the SSH port is not listed, you can allow it using:

sudo ufw allow ssh

If your server uses a custom SSH port (e.g., 2222), replace ssh with the port number:

sudo ufw allow 2222

After executing the command, the firewall will be updated to permit incoming SSH connections.

4. Cause: Incorrect SSH Credentials or Port Configuration

To establish an SSH connection from your client to a server, you must provide specific credentials. If any of these settings are incorrect, the server will respond with a “Connection refused” message.

Here are the details required for an SSH connection:

1. Hostname: This refers to the server’s address, which can be its IP address, server name, or your website’s domain (if the domain’s A record points to the server).

2. SSH username: You must provide the username associated with the SSH server on the website or server.

3. Password: If you’re using password-based authentication, ensure you enter the correct password. If you’re using SSH keys, the password prompt refers to the passphrase for your private SSH key.

4. Port: The default port for SSH connections is 22. However, many hosting providers use a custom SSH port instead for enhanced security. For example, in Cloudways, the SSH port is 4200.

You can verify if you have the correct SSH port open by running the following command:

grep Port /etc/ssh/sshd_config

Executing this command will display the output that shows the port number being used for SSH.

Solution: Double-Check the Credentials You’re Entering

Log in to your hosting provider’s control panel to ensure you have the correct credentials. Look for a section that displays the SSH credentials.

In the Cloudways platform, for instance, you can find the host, application username, and password under the SSH/SFTP section. Make sure to take note of these details and use them exactly.

When entering your credentials, it is crucial to double-check and consider the possibility of typos or mistakenly entering the wrong IP address or port. Take care to verify the accuracy of your credentials to ensure they are entered correctly.

5. Cause: SSH Service Not Running or Needs Restarting

Another option to address the SSH “Connection Refused” error is to restart the SSH service.

Solution: Restart SSH Service

To restart the SSH service, use one of the following commands:

sudo service ssh restart

or

sudo systemctl restart sshd

The command will restart the SSH service. This action allows the SSH service to restart fresh, potentially resolving any underlying problems and establishing successful SSH connections.

Any potential issues or glitches preventing SSH connections can be resolved by restarting the SSH service.

Note: The command sudo service ssh restart may not work on all systems. Some systems use systemctl.

6. Cause: SSH Access Has Been Disabled

In some cases, the SSH daemon may be installed on the server but disabled for security reasons. If SSH access is disabled, the server will refuse incoming SSH connection requests.

Solution: Enable SSH Access

To enable SSH access, start the SSH service using the following command:

sudo service ssh start

If the command executes without errors, the SSH service has been started successfully. If the service is already running, this command will not make any changes.

You can also enable the SSH service to start automatically on system boot with:

sudo systemctl enable ssh

This ensures that SSH remains active even after a server reboot.

7. Cause: SSH Port Is Closed

SSH connections rely on a specific port (default is 22) to communicate with the server. If this port is closed, the server will refuse SSH connection requests.

Solution: Open the SSH Port

1. Check If the SSH Port Is Open

To check whether your SSH port is open and listening, run:

sudo lsof -i:22

If the output includes LISTEN under the STATE column, the port is open. Otherwise, you need to open it.

Note for Cloudways Users:

sudo commands like lsof -i:22 are restricted on Cloudways-managed servers. Instead, use:

netstat -tnl | grep :22

In my case, the output indicates that SSH is running and actively listening on port 22 for both IPv4 (0.0.0.0:22) and IPv6 (:::22).

If there’s no output, it means port 22 is closed.

Note: Why Can’t I Have Root Access to My Server on Cloudways?

2. Verify SSH Port Configuration

To check which port SSH is using, run:

grep Port /etc/ssh/sshd_config

If the port is commented out (#Port 22) or changed (e.g., Port 2222), edit the configuration file:

sudo nano /etc/ssh/sshd_config

• Uncomment the Port line (#Port 22 → Port 22)
• If another port is needed, update it accordingly
• Save and exit (CTRL + X, then Y, then Enter)

3. Restart SSH Service

Once the port is updated, restart the SSH service:

sudo service ssh restart

or

sudo systemctl restart ssh

Managed hosting servers don’t allow direct SSH service restarts. So if you’re a Cloudways user, instead of running the commands, go to:

• Cloudways Platform → Servers → Security Tab
• Ensure your IP is whitelisted under Allowed IPs

4. Open SSH Port in Firewall

If SSH is blocked due to firewall rules, allow traffic on port 22:

sudo ufw allow 22

Additional Tips and Best Practices for SSH Troubleshooting

Now that we’ve looked at some problems and solutions to resolve the SSH “Connection Refused” Error, let’s explore additional tips and best practices for SSH troubleshooting.

1. Exploring SSH Debugging and Logging Techniques

You can use the verbose or debugging modes to analyze SSH problems in Linux. Enabling this mode allows SSH to display detailed debugging messages, aiding in troubleshooting connection, configuration, and authentication issues.

There are three levels of verbosity available:

Level 1 (-v): To activate this level, you can add option -v when accessing a remote server using the ssh command. For example:

ssh -v [server_ip]

Level 2 (-vv): This level provides a higher verbosity level. You can enable it using the -vv option:

ssh -vv [server_ip]

Level 3 (-vvv): This level offers the highest verbosity level and provides the most detailed debugging information. To activate it, you can use the -vvv option:

ssh -vvv [server_ip]

By running the SSH command with the desired level of verbosity, you can obtain valuable insights into any issues occurring during the SSH connection process.

Apart from verbose mode, you can also use another method to diagnose SSH problems by examining the system logs.

Linux distributions typically store SSH-related logs in files such as /var/log/auth.log or /var/log/secure. You can check these logs for any error messages or warnings related to SSH connections.

By utilizing verbose mode and reviewing system logs, you can better understand SSH problems and troubleshoot them effectively.

2. Implementing SSH Security Practices

Implementing proper security practices is essential to protect your SSH connections and ensure theof your system.

Consider the following practices:

1. Disable SSH password authentication: Instead of relying on passwords, use SSH key-based authentication. This method provides stronger security by using public-private key pairs.

2. Set strong passwords/passphrases: If you still use password authentication, ensure you set strong, unique passwords or passphrases for your SSH accounts. Use a combination of uppercase and lowercase letters, numbers, and special characters.

3. Limit SSH access: Restrict SSH access to only authorized users. Regularly review and update the list of allowed users to minimize potential vulnerabilities.

4. Configure SSH to use a non-default port: Changing the default SSH port (22) to a different, non-standard port can help reduce the number of automated scanning attempts and potential attacks targeting SSH.

5. Utilize firewall rules: Configure firewall rules to allow SSH connections only from trusted IP addresses or network ranges. This adds an extra layer of protection by limiting SSH access to specific sources.

6. Disable SSH root login: Disable direct root login via SSH. Instead, use a regular user account and switch to the root user using the sudo command when necessary. This prevents unauthorized access attempts targeting the root account.

7. Regularly review SSH logs: Monitor and review SSH logs for suspicious activities or failed login attempts. Unusual or repeated failed login attempts may indicate brute force or other malicious activities.

3. Regular Updates and Maintenance of SSH Components

Regular updates and maintenance of your SSH components are crucial for keeping your system secure and up-to-date.

Consider the following practices:

1. Keep SSH software updated: Stay current with the latest versions of SSH software, including both the client and server components. Regularly update your system’s SSH packages or software to benefit from security patches and bug fixes.

2. Enable automatic updates: Configure your system to update SSH software whenever updates are available automatically. This ensures that critical security patches are promptly installed.

3. Periodically review SSH configurations: Regularly review and audit your SSH configurations, including SSH server settings and client configurations, to ensure they align with your security requirements and best practices.

4. Backup SSH configurations and keys: Create regular backups of your SSH configurations and key files. This helps protect against accidental loss or corruption of SSH settings and ensures you can restore them if needed.

5. Monitor SSH vendor announcements: Stay informed about security advisories and announcements from SSH software vendors or distributions. Subscribe to relevant security mailing lists or follow official channels to receive timely information about vulnerabilities and patches.

By implementing these SSH security practices and maintaining regular updates and maintenance, you can enhance the security and stability of your SSH connections and mitigate potential risks.

While working on SSH troubleshooting, you might also come across issues related to your website or web application. To learn more about addressing common website issues, check out our comprehensive guide on how to fix common WordPress issues. This resource will help you identify and tackle various problems that may arise during the maintenance and management of your WordPress site.

Summary

Resolving the “SSH Connection refused” error is crucial for establishing secure remote access to your WordPress website. Throughout this troubleshooting guide, we have explored the common causes of the error and provided practical methods to address them.

Understanding the root causes, such as missing SSH clients, firewall blocking, incorrect credentials or port configuration, and SSH service issues, empowers you to troubleshoot and resolve the error effectively.

By following the step-by-step methods outlined, including installing/configuring SSH clients, ensuring the presence of SSH daemons, addressing firewall issues, verifying credentials and port configuration, and restarting/enabling the SSH service, you can overcome these challenges and establish a successful SSH connection to your WordPress website.