Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to open a ssh terminal but it gives me a connection refused on port 22. My nmap doesn't list a port 22? How can I connect to my server?

 PORT     STATE    SERVICE
 21/tcp   open     ftp
 25/tcp   open     smtp
 80/tcp   open     http
 4000/tcp filtered remoteanything
 4001/tcp filtered newoak
 4002/tcp filtered mlchat-proxy

This is my port scan from hackertarget.com:

 PORT     STATE  SERVICE      VERSION
 21/tcp   open   ftp          ProFTPD 1.3.1
 22/tcp   closed ssh
 25/tcp   open   smtp         Postfix smtpd
 80/tcp   open   http         lighttpd 1.4.29
 110/tcp  closed pop3
 139/tcp  closed netbios-ssn
 143/tcp  closed imap
 443/tcp  closed https
 445/tcp  closed microsoft-ds
 1433/tcp closed ms-sql-s
 3306/tcp closed mysql
 8080/tcp closed http-proxy

How can sshd be closed?

share|improve this question
    
Have you confirmed that port 22 is not blocked and your sshd is running? –  jw013 Apr 16 '12 at 22:42
    
jw013: It's a remote server and usually it's running sshd but I'm trying to open a terminal from another place. When I run a remote nmap how can it be that port 22 isn't listed. I've some antihacker script on my server can that block nmap? –  Phpdna Apr 16 '12 at 22:55
    
Nmap hides closed or filtered ports by default, whichever there are more of. For instance, your output probably says Not showing 994 closed ports right above what you pasted here. A closed port would give the same "connection refused" error you're getting from ssh. –  bonsaiviking Apr 16 '12 at 23:02
    
@bonsaiviking: I've edited my questions. It seems that sshd is down but I want to know why? How can I explain that to my adminstrator? I can only reboot the server from a web shell? –  Phpdna Apr 16 '12 at 23:19
    
What was the nmap command and flags you used? –  jippie Apr 17 '12 at 6:38

2 Answers 2

You can check the status of your ssh server remotely by using nmap

 $ nmap -v -nn serverip 22

If it shows that the ssh-server is down, then you have to get some local access to the ssh-server and execute command like:

 $ /etc/init.d/ssh status

If this show ssh service is down, then you have to start it by

 $ sudo /etc/init.d/ssh start

or

 $ service ssh start
share|improve this answer

If your connection is refused, and Nmap shows the port to be closed, then you cannot connect. If you have some other way (physical terminal, virtual console, etc) to get access, you can confirm whether the SSH daemon is running with any of these commands (some may not be available on your system):

ps -f -C sshd
ps aux | grep sshd
sudo netstat -ptan | grep sshd
service ssh status

If it is not running, you need to start it. Common ways of doing this are:

service ssh start
invoke-rc.d ssh start
/etc/init.d/ssh start
/usr/sbin/sshd

All of these commands should require root privileges (e.g. sudo).

If the daemon is running, but you still can't connect, then it's possible a network device or your host's iptables firewall is blocking connections. You can see your own rules with iptables -L, but if you are using a firewall manager (UFW is popular on Ubuntu), the tables may be hard to read, and you should check the user interface for the tool you are using (ufw status, for example). It's not likely that a network device is blocking it, since your Nmap output shows a few filtered (firewalled) ports, and 22/tcp is not among them.

Lastly, there are some defense tools and scripts (like fail2ban and others) that can block addresses for violating policies (like too many failed login attempts), so you may need to check the logs for things like that.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.