nmap isn't showing sshd?

Question

I want to open a ssh terminal but it gives me a connection refused on port 22. My nmap doesn't list a port 22? How can I connect to my server?

 PORT     STATE    SERVICE
 21/tcp   open     ftp
 25/tcp   open     smtp
 80/tcp   open     http
 4000/tcp filtered remoteanything
 4001/tcp filtered newoak
 4002/tcp filtered mlchat-proxy

This is my port scan from hackertarget.com:

 PORT     STATE  SERVICE      VERSION
 21/tcp   open   ftp          ProFTPD 1.3.1
 22/tcp   closed ssh
 25/tcp   open   smtp         Postfix smtpd
 80/tcp   open   http         lighttpd 1.4.29
 110/tcp  closed pop3
 139/tcp  closed netbios-ssn
 143/tcp  closed imap
 443/tcp  closed https
 445/tcp  closed microsoft-ds
 1433/tcp closed ms-sql-s
 3306/tcp closed mysql
 8080/tcp closed http-proxy

How can sshd be closed?

Answer 1

If your connection is refused, and Nmap shows the port to be closed, then you cannot connect. If you have some other way (physical terminal, virtual console, etc) to get access, you can confirm whether the SSH daemon is running with any of these commands (some may not be available on your system):

ps -f -C sshd
ps aux | grep sshd
sudo netstat -ptan | grep sshd
service ssh status

If it is not running, you need to start it. Common ways of doing this are:

service ssh start
invoke-rc.d ssh start
/etc/init.d/ssh start
/usr/sbin/sshd

All of these commands should require root privileges (e.g. sudo).

If the daemon is running, but you still can't connect, then it's possible a network device or your host's iptables firewall is blocking connections. You can see your own rules with iptables -L, but if you are using a firewall manager (UFW is popular on Ubuntu), the tables may be hard to read, and you should check the user interface for the tool you are using (ufw status, for example). It's not likely that a network device is blocking it, since your Nmap output shows a few filtered (firewalled) ports, and 22/tcp is not among them.

Lastly, there are some defense tools and scripts (like fail2ban and others) that can block addresses for violating policies (like too many failed login attempts), so you may need to check the logs for things like that.

Answer 2

You can check the status of your ssh server remotely by using nmap

 $ nmap -v -nn serverip 22

If it shows that the ssh-server is down, then you have to get some local access to the ssh-server and execute command like:

 $ /etc/init.d/ssh status

If this show ssh service is down, then you have to start it by

 $ sudo /etc/init.d/ssh start

or

 $ service ssh start