Can't Connect to Your VPS? SSH Login Failure Solutions

This sounds silly, but I've really seen quite a few people copy the IP wrong. Especially with a freshly provisioned VPS, it's normal to get dizzy looking at that string of IPs in the email.

# 标准 SSH 连接命令
ssh root@你的IP地址

# 如果端口不是 22
ssh -p 端口号 root@你的IP地址

Many VPS providers, for security, don't use port 22 as the default SSH port. BandwagonHost gives a random high port by default, while Vultr and Linode still use 22. Remember to check the actual port number in the control panel.

The initial password sent by the provider is usually long and ugly, something like xK9#mP2$vL5@nQ8. The most common problems when copying are:

• Extra spaces before or after
• Special characters getting swallowed
• Only copying part of it

I suggest using a password manager directly, or manually typing it out character by character.

Check in the provider's control panel that the VPS status is Running. Sometimes you forget to renew and it gets suspended, or the OS reinstall hasn't finished, and either way you can't connect.

ping 你的IP地址

Ping works but SSH won't connect: this means the network is fine, and the problem is in the SSH service or the firewall.

Ping fails: it could be one of these situations:

1. IP is blocked - a common problem in mainland China, especially for VPSs used for certain purposes
2. Provider network problem - data center failure or maintenance
3. Local network problem - company or school networks may have restrictions

To determine whether it's blocked, try mobile data or a different network environment. If mobile 4G can ping it but your home broadband can't, it's most likely a carrier problem.

# Linux/Mac
nc -zv 你的IP地址 22

# 或者用 telnet
telnet 你的IP地址 22

If it says "Connection refused", the port isn't open or the service isn't running. If it just hangs with no response, the firewall may be blocking it.

You can also use an online tool to test; search for "port checker online" and pick any website to test.

Almost all VPS providers offer a web console or VNC feature; look for the "Console" or "VNC" button in the control panel. This way you can operate the VPS directly without relying on SSH.

After logging in:

# 检查 SSH 服务状态
systemctl status sshd

# 如果没运行，启动它
systemctl start sshd

# 设置开机自启
systemctl enable sshd

The reasons for SSH login failures are all recorded in the logs:

# Debian/Ubuntu
tail -100 /var/log/auth.log

# CentOS/RHEL
tail -100 /var/log/secure

Common error messages:

• Failed password - wrong password
• Connection closed by authenticating user - wrong authentication method
• Permission denied (publickey) - only key login is allowed but you used a password
• Too many authentication failures - too many attempts, temporarily banned

# 查看当前规则
iptables -L -n

# 如果规则太乱，先允许 SSH
iptables -I INPUT -p tcp --dport 22 -j ACCEPT

# 如果端口改过
iptables -I INPUT -p tcp --dport 你的SSH端口 -j ACCEPT

# 查看状态
firewall-cmd --state

# 查看开放的端口
firewall-cmd --list-ports

# 开放 SSH 端口
firewall-cmd --permanent --add-port=22/tcp
firewall-cmd --reload

# 查看状态
ufw status

# 允许 SSH
ufw allow ssh
# 或者指定端口
ufw allow 22/tcp

A painful lesson: before changing firewall rules, always keep an already-connected session open. Once I changed iptables and locked myself out, and could only reinstall the system.

cat /etc/ssh/sshd_config | grep -v "^#" | grep -v "^$"

Focus on these items:

Port 22                    # 端口号
PermitRootLogin yes        # 是否允许 root 登录
PasswordAuthentication yes # 是否允许密码登录
PubkeyAuthentication yes   # 是否允许密钥登录

If PermitRootLogin is no, you can't log in as root. If PasswordAuthentication is no, only keys can be used.

Remember to restart the service after modifying the configuration:

systemctl restart sshd

If you make a typo while editing the configuration file, the SSH service may fail to start. Check the syntax:

sshd -t

No output means no problem; if there's an error, it will show which line has the problem.

SSH is very strict about file permissions:

# 服务器端
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

# 本地
chmod 600 ~/.ssh/id_rsa

If permissions are too loose (such as 777), SSH will refuse to use these files.

The public key must be added to the ~/.ssh/authorized_keys file, one public key per line. Check it:

cat ~/.ssh/authorized_keys

Make sure:

• The public key is a complete single line, not truncated by a line break
• The format is correct, starting with ssh-rsa or ssh-ed25519

If you have multiple keys, specify one when connecting:

ssh -i ~/.ssh/my_custom_key root@你的IP

After a few wrong passwords, fail2ban will temporarily ban your IP. After logging in via VNC:

# 查看被封的 IP
fail2ban-client status sshd

# 解封
fail2ban-client set sshd unbanip 你的本地IP

Check whether you've been added to the blacklist:

cat /etc/hosts.deny

If you see your IP or something like ALL: ALL, delete or comment it out.

On CentOS, SELinux sometimes blocks SSH, especially after changing to a non-standard port:

# 查看 SELinux 状态
getenforce

# 临时关闭
setenforce 0

# 或者允许新端口
semanage port -a -t ssh_port_t -p tcp 你的新端口

Insufficient disk space causes all kinds of strange problems:

df -h

If the root partition is 100% used, SSH may not work properly. Clean up some log files or temporary files.