Fix SSH Connection Closed by Remote Host Errors

When you try to connect to a server over SSH and get “Connection closed by remote host,” it means the server accepted the TCP connection but then dropped it before the SSH handshake completed. This guide walks through the most common causes—from wrong credentials and firewall rules to key permission issues and server-side configuration—and shows you how to fix each one step by step.

What You’ll Need

• Access to the SSH client machine (your local computer)
• Access to the remote server (console, web panel, or physical access)
• SSH client installed (OpenSSH on Linux/macOS, or PuTTY on Windows)
• Basic command-line familiarity

Step-by-Step

1. Check the exact error message. Run your SSH command with verbose output: ssh -vvv user@host. Look for lines like “Connection closed by remote host” and any earlier messages about authentication, key exchange, or protocol errors. The extra detail often points directly to the cause.
2. Verify the server is actually running SSH. From the server console, run sudo systemctl status sshd (or ssh on older systems). If it’s not running, start it with sudo systemctl start sshd and enable it with sudo systemctl enable sshd. On some systems the service is named ssh instead of sshd.
3. Check the SSH port. The default is 22. If the server uses a custom port, you must specify it with ssh -p PORT user@host. Also verify the server’s firewall allows that port: on the server, run sudo ufw status (Ubuntu/Debian) or sudo firewall-cmd --list-all (CentOS/RHEL). If the port is blocked, open it with sudo ufw allow PORT or the equivalent firewall-cmd command.
4. Test with a different authentication method. If you’re using an SSH key, try password authentication: ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@host. If that works, the problem is with your key. If password also fails, the issue is likely server-side or network-related.
5. Check your SSH key permissions. On the client, your private key (~/.ssh/id_rsa or similar) must have permissions 600, and the ~/.ssh directory must be 700. Fix with chmod 600 ~/.ssh/id_rsa and chmod 700 ~/.ssh. On the server, the authorized_keys file must be 600 and owned by the user: chmod 600 ~/.ssh/authorized_keys.
6. Verify the public key is in the right place. On the server, the public key must be in ~/.ssh/authorized_keys of the user you’re logging in as. Check with cat ~/.ssh/authorized_keys and ensure your key is there. If not, add it: echo "ssh-rsa AAAA..." >> ~/.ssh/authorized_keys.
7. Inspect the server’s SSH log. On the server, look at /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (CentOS/RHEL). Search for lines around the time of your attempt. Common entries include “Connection closed by authenticating user” (key problem), “error: maximum authentication attempts exceeded” (too many keys), or “fatal: no more authentication methods available”.
8. Check server configuration for restrictions. Look at /etc/ssh/sshd_config. Verify that PasswordAuthentication is set to yes if you use passwords, and PubkeyAuthentication is yes for keys. Also check AllowUsers, AllowGroups, or DenyUsers directives that might block your user. After editing, restart sshd: sudo systemctl restart sshd.
9. Test from a different client or network. Try connecting from another computer or from a phone with a terminal app. If that works, the issue is local to your client or your network. If it fails everywhere, the server is the problem.
10. Check for IP blocking or fail2ban. If you’ve had failed login attempts, fail2ban might have banned your IP. Check with sudo fail2ban-client status sshd and unban with sudo fail2ban-client set sshd unbanip YOUR_IP if needed.
11. Verify DNS and hosts file. If you’re using a hostname, ensure it resolves correctly. Try connecting via IP address instead. On the client, check /etc/hosts for any stale entries.
12. Check for resource exhaustion on the server. Run df -h and free -h on the server. A full disk or out-of-memory condition can cause SSH to drop connections. Free up space or restart the server if necessary.

Common Mistakes

• Ignoring the verbose output. The -vvv flag is your best diagnostic tool. Many users skip it and guess blindly.
• Wrong file permissions. SSH is strict about permissions. A world-readable private key or authorized_keys file will cause the connection to be closed.
• Using the same key for multiple servers. While not inherently wrong, if the key is compromised or the server has a different key type, it can cause issues. Generate a new key per server if needed.
• Forgetting to specify the port. If the server runs SSH on a non-standard port, you must add -p. Many users forget and get a connection refused or timeout instead.
• Editing sshd_config incorrectly. A syntax error in sshd_config will prevent SSH from starting. Always test with sshd -t before restarting.

Tips

• Use SSH keys instead of passwords for better security and fewer authentication failures.
• Keep your SSH client and server up to date to avoid protocol mismatch issues.
• If you’re behind a NAT or firewall, consider using a VPN or port forwarding for reliable connections.
• For persistent connections, use ServerAliveInterval 60 in your SSH config to keep the session alive.
• When troubleshooting, temporarily disable the server’s firewall to see if it’s the culprit, but re-enable it once you find the issue.

Troubleshooting

If the steps above don’t resolve the issue, try these additional checks:

• Check if the server is reachable at all. Run ping host and telnet host 22 (or nc -vz host 22). If ping fails, it’s a network issue. If telnet fails, the port is closed or filtered.
• Look for SELinux or AppArmor blocking. On CentOS/RHEL, SELinux might block SSH. Check with getenforce. Temporarily set to permissive with setenforce 0 to test. On Ubuntu, check AppArmor status with sudo aa-status.
• Check for TCP wrappers. Some systems use /etc/hosts.allow and /etc/hosts.deny. Ensure your IP is allowed.
• Try a different SSH client. If you’re on Windows, try PuTTY instead of OpenSSH. If you’re on Linux, try ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 to work around old key exchange algorithms.
• Review the server’s syslog. Sometimes the issue is not in auth.log but in the main syslog. Look for messages about sshd crashing or resource limits.

Frequently Asked Questions

Why does SSH say “Connection closed by remote host” immediately after entering my password?

This typically means the server accepted the password but then failed to set up the session. Common causes include a full disk, incorrect home directory permissions, or a missing shell for the user.

Can a firewall cause this error?

Yes. If the firewall drops packets after the initial handshake, you’ll see this error. Check both the server’s firewall and any network firewalls in between.

What does “Connection closed by remote host” mean exactly?

It means the remote server closed the TCP connection before the SSH protocol completed. It’s a generic message that can have many underlying causes.

How do I fix permission issues on my SSH key?

On the client, run chmod 600 ~/.ssh/id_rsa and chmod 700 ~/.ssh. On the server, ensure authorized_keys is 600 and owned by the correct user.

Why does SSH work locally but not from the internet?

This usually indicates a firewall or NAT issue. Check that port 22 is forwarded to the server and that the firewall allows traffic from the internet.

What if I still can’t connect after trying everything?

Consider reinstalling the SSH server package (sudo apt-get install --reinstall openssh-server on Debian/Ubuntu) or restoring from a backup. Also check if the server’s IP address has changed.

Related

• FC 26 Flow State Evolution Best Cards to Build Around
• Used Wacom Tablet Registration: What You Can and Can’t Do
• Xiaomi 17T vs 17T Pro: Worth the Extra Cost?