How to fix ssh: connect to host hostname port 22: Connection refused in SSH

First, confirm the remote server is reachable on the network using ping:

ping <server_ip_or_hostname>

If ping fails, there's a network connectivity issue. Check your network connection, VPN, or firewall rules between your client and the server. If you're connecting through a proxy or jump host, verify that configuration is correct.

Log in to the remote server locally or through another method (console, remote desktop) and check if the SSH daemon is running:

sudo systemctl status ssh

Or on some systems:

sudo systemctl status sshd

If the service is inactive, stopped, or dead, the SSH daemon is not running and needs to be started.

If SSH is not running, start it immediately and enable it to start automatically on boot:

sudo systemctl start ssh
sudo systemctl enable ssh

Or use the older service syntax:

sudo service ssh start

After starting, verify it's running with the status command from the previous step. Then try your SSH connection again.

Check what port the SSH server is listening on. By default it's port 22, but some administrators change this for security:

grep Port /etc/ssh/sshd_config

If it shows a port other than 22, connect using that port:

ssh -p <port_number> user@hostname

Also check if SSH is actually listening on that port:

sudo netstat -tlnp | grep ssh

or

sudo ss -tlnp | grep ssh

The server's firewall may be blocking SSH connections. Check your active firewall and add a rule to allow port 22:

For UFW (Ubuntu/Debian):

sudo ufw status
sudo ufw allow 22
sudo ufw reload

For firewalld (CentOS/RHEL):

sudo firewall-cmd --list-all
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

For iptables (manual rules):

sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

Note: This is not persistent across reboots. Consider using UFW or firewalld instead.

Use telnet or nc (netcat) to verify the port is open and listening:

telnet <server_ip> 22

or

nc -zv <server_ip> 22

A successful response means the port is open. If it times out or refuses, the port is blocked or not listening.

If SSH is running but still refusing connections, check the SSH service logs for configuration errors or crash messages:

sudo tail -f /var/log/auth.log

or on Red Hat/CentOS:

sudo tail -f /var/log/secure

Or use journalctl:

sudo journalctl -u ssh -n 50
sudo journalctl -u sshd -n 50

Look for errors related to port binding, configuration parsing, or permission issues.

Use SSH verbose mode to see detailed connection attempts and identify where the connection fails:

ssh -vvv user@hostname

With three -v flags, you'll see:
- Connection attempt details
- Which port is being tried
- Protocol negotiation
- Authentication attempts

This output often reveals whether the connection is being refused at the network level or by the SSH service itself.