Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsStart by separating the failure into one of four layers: the machine or endpoint, the network path, the SSH service, or authentication. A running virtual machine does not prove that its address is current, port 22 is reachable, sshd is listening, or your key is accepted. Identify the exact error, test the affected layer, then use an alternate management channel if SSH or the console is unavailable.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Identify what kind of failure you have
The wording of the client error is useful evidence. Do not treat every failed SSH attempt as a firewall problem: each message points to a different stage of the connection.
As an Amazon Associate I earn from qualifying purchases.
| What you see | What it usually proves | First checks |
|---|---|---|
Connection timed out |
No response returned from the destination path before the client deadline. | Current DNS name or IP, route, security group, network ACL, provider firewall, local firewall, and port 22 reachability. |
Connection refused |
The host was reached, but no service accepted the TCP connection on that port, or the host actively rejected it. | Whether sshd is running, which port it listens on, host firewall rules, and port conflicts. |
Permission denied or Server refused our key |
Network communication reached SSH, but authentication failed. | Exact username, matching private key, authorized-key entry, and private-key permissions. |
| Blank console, boot error, or an unresponsive serial screen | The problem may occur before networking or SSH starts. | Provider status checks, boot and system logs, serial or out-of-band access, and a rescue workflow. |
A timeout means the client did not receive a response; AWS describes this as the server not responding to the request. A refusal is different: the host was contacted, but no SSH service accepted the connection on the requested port. Use those distinctions to avoid changing credentials when the real problem is routing, or changing firewall rules when the daemon is simply stopped.
Confirm the machine and endpoint before changing anything
Check instance health and power state
In your hosting provider’s management panel, verify that the intended instance is running and has passed its provider status checks. A failed health check can indicate a platform, boot, storage, or network problem that an SSH command cannot fix. Record the instance identifier and the time of the failure before rebooting or editing configuration.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Verify the address and username
Confirm the current public DNS name or IP address. Ephemeral addresses can change after a stop and start, and a stale DNS record can make a healthy server appear offline. Verify the operating-system account as well: common images use different default users, and the correct account is part of authentication, not a cosmetic detail.
Match the private key and protect it
Use the private key paired with the public key installed for this instance. Check that the file is readable only by the account running the SSH client; a typical Unix adjustment is chmod 400 key_pair.pem, subject to the permissions required by your provider and operating system. Do not replace server networking rules until you have ruled out a wrong key, wrong user, or an unreadable key file.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCollect client-side evidence
Test whether TCP port 22 responds
From the client network, test the destination directly:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
nc -zv HOST 22Replace HOST with the confirmed DNS name or IP. A successful result shows that a TCP path to port 22 exists; it does not prove that authentication will succeed. A timeout keeps the investigation at the address, route, access-control, or firewall layer. A refusal means the host answered but no listener accepted the connection.
Run SSH in verbose mode
Capture the connection stages with:
ssh -i key_pair.pem user@HOST -vvvThe verbose output helps distinguish DNS resolution, TCP connection, host-key negotiation, and user authentication. Save the output for comparison after each change, while removing private material before sharing logs. If the trace reaches authentication and ends with a key rejection, focus on the account name, authorized keys, and file ownership rather than port rules.
Use an alternate management path when SSH is down
A second channel can let you repair SSH without exposing or guessing at port 22. AWS’s guidance is explicit: “If one connection method doesn’t work, then use another connection method to access your instance and troubleshoot issues.” Availability and prerequisites differ by account, image, region, provider, and operating system.
Recommended Free Tools
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
| Recovery path | Needs port 22? | Typical prerequisites | Useful when | Access and audit characteristics |
|---|---|---|---|---|
| Systems Manager Session Manager | No | A supported management agent, suitable instance permissions or IAM role, and provider connectivity. | The operating system is running but SSH networking or credentials are broken. | Provides a managed interactive session and provider-side audit features; exact logging depends on configuration. |
| EC2 Instance Connect | Usually reaches the instance through SSH, so the SSH path still must be available. | Supported image and account permissions, plus a reachable SSH endpoint. | Short-lived key delivery is preferable to distributing a permanent private key. | Interactive shell with provider-controlled access events; it does not replace a dead listener or blocked route. |
| EC2 Serial Console | No | Account, region, instance, and operating-system support, with console access enabled. | Boot, networking, firewall, or SSH failures prevent normal network login. | Out-of-band terminal access; it may expose boot output and a shell but is not a general file-transfer channel. |
| Rescue instance or offline disk attachment | No | Permission to stop or detach storage and attach it to a helper system, following provider procedures. | The affected system will not boot or no interactive channel works. | Allows log inspection and file repair offline; preserve the original disk and document every change. |
Do not assume that an alternate channel works during every failure. An agent-based session generally requires a booted operating system and its management agent; a serial channel can work when network configuration is broken but may not be available for every image; a rescue instance requires storage and provider operations that can affect downtime.
Repair SSH from an available shell
Once Session Manager, a serial console, a provider console, or another approved shell is available, work from evidence rather than making several broad changes at once.
- Check the service state. Run
sudo systemctl status sshd. Some distributions register the unit asssh, so use the distribution’s actual service name ifsshdis not found. If the service is stopped or failed, inspect its immediate error before restarting it. - Read recent service logs. Use
sudo journalctl -u sshd --no-pager -n 50(or the correspondingsshunit). Look for configuration parse errors, missing host keys, permission failures, unavailable libraries, or a bind error indicating that another process owns the port. - Validate configuration without restarting. Run
sudo sshd -t. A non-zero result means the configuration is invalid; correct the reported line and run the test again. Do not restart a daemon with an unvalidated configuration when your alternate channel may be your only access. - Check the listening socket. Run
sudo ss -tlnp | grep :22. Confirm that an SSH process is listening on the expected address and port. If the configuration deliberately uses another port, test that port from the client and ensure provider and host firewall rules match it. If another process owns port 22, resolve the conflict before restarting SSH. - Verify host keys. If logs show that required host keys are missing,
sudo ssh-keygen -Aregenerates the standard set on systems that support this command. Check ownership and permissions afterward so the daemon can read the keys without making them broadly accessible. - Check account-key files. Confirm that the intended user’s authorized-key file contains the matching public key, and that the home directory,
.sshdirectory, and authorized-key file have ownership and restrictive permissions appropriate to the operating system. Correct the key or username only after confirming which account the image expects. - Check firewalls at both layers. Review the provider security group or equivalent, network ACL, provider firewall, and the operating system’s local firewall. Permit the intended source and port narrowly. A local rule can block a reachable host, while a provider rule can prevent packets from ever reaching it.
- Check package integrity. If the logs identify missing dependencies or a damaged OpenSSH installation, reinstall the distribution’s OpenSSH server packages using the provider’s documented package manager and repository. Avoid removing configuration files without a backup.
- Restart only after validation. Run
sudo systemctl restart sshd(orssh), then immediately checksudo systemctl status sshdand the latest journal entries. Test from a separate client while the alternate channel remains open.
The key diagnostic principle is that a running instance and a healthy SSH daemon are separate facts. AWS notes that if sshd does not start, SSH access fails even when the instance is running and network connectivity is correct.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
When the console is blank or the machine will not boot
Capture diagnostics before rebooting
If a console displays a boot error, kernel panic, filesystem failure, or no useful output, record the visible message and provider status information. Capture available serial output and system logs before a reboot or repair operation; a restart can overwrite the most useful evidence or change the failure state.
Use serial or provider console controls carefully
An out-of-band serial console can expose boot prompts and a root or emergency shell when the network stack is not functional. Console labels, permissions, and supported operating systems vary. If you can reach an emergency shell, check mounts, filesystem space, failed units, recent journal entries, and the SSH configuration before forcing another reboot.
Consider a controlled reboot
Reboot only after recording diagnostics and confirming that the workload can tolerate downtime. A reboot may clear a transient process failure, but it will not repair a persistent firewall rule, invalid configuration, missing package, or damaged filesystem. Keep the alternate channel available so you can observe the next boot.
If no management channel works: rescue the disk
Use the provider’s documented rescue-instance or disk-attachment workflow when SSH, the regular console, serial access, and agent-based sessions are all unavailable. AWS describes attaching the affected storage to a rescue instance to inspect logs and repair the system.
- Record the instance, volume, snapshot, and failure time. Preserve a snapshot or other copy when the provider supports it.
- Stop or detach storage only through the provider’s supported procedure, recognizing that this can cause downtime and may not be safe for every storage type.
- Attach the volume to a helper system without mounting it read-write until you understand the filesystem and repair goal.
- Inspect service logs, SSH configuration, firewall configuration, authorized keys, permissions, disk usage, and boot files from the mounted filesystem.
- Make the smallest reversible correction, such as fixing a syntax error, restoring a missing host key, or correcting ownership. Keep a record of each file changed.
- Unmount cleanly, reattach the volume to the original instance, and test provider health, boot output, port reachability, service state, and authentication in that order.
Do not use an offline repair as an excuse to replace all credentials or disable every firewall. Broad changes destroy evidence and can create a second security incident.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Prevent the next lockout
- Maintain at least one tested alternate management path, and verify its permissions, agent, role, and regional availability before an outage.
- Document each image’s expected username, key location, SSH port, service-unit name, and console procedure.
- Keep provider status checks, security-group changes, firewall changes, and SSH configuration changes in an auditable record.
- Validate SSH configuration with
sshd -tbefore restarting after an edit. - Monitor disk space, failed services, and SSH logs so a full filesystem or repeated daemon failure is visible before access is lost.
- Store recovery keys and console credentials securely, separately from the server, and test that an authorized operator can use them.
- Practice a rescue-instance or offline-disk procedure on a non-production system so the first real outage is not the first time you attempt it.
A compact decision sequence
- Confirm the instance is the intended machine, running, and passing provider status checks.
- Confirm its current DNS name or IP, expected username, matching private key, and restrictive key permissions.
- Classify the message as timeout, refusal, authentication failure, or boot/console failure.
- Run
nc -zv HOST 22andssh -i key_pair.pem user@HOST -vvvfrom the client. - For a timeout, inspect address, route, provider controls, network ACLs, and both firewalls.
- For a refusal, inspect the SSH service, configuration syntax, listener port, port conflicts, and host firewall.
- For authentication errors, verify username, authorized key, private-key match, and permissions.
- Use Session Manager, a serial console, an approved provider console, or a rescue workflow when the normal path cannot reach the server.
- Preserve evidence, make one focused repair, validate it, and retest before moving to a broader change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
