How to fix Failed password for user from hostname port XXXXX ssh2 in SSH

SSHBEGINNERMEDIUMUpdated Jan 4, 2026· 364 views

SSH authentication failed because the password you entered is incorrect, or the user account doesn't have password authentication enabled. Common causes include wrong credentials, disabled password auth, or account restrictions.

Quick fix

Fixes Failed password for user from hostname port XXXXX ssh2

# Attempt login with explicit username
ssh username@hostname
# Or with a specific port if SSH runs on a non-standard port
ssh -p 2222 username@hostname
  1. Verify you're using the correct username and password
  2. Check if password authentication is enabled on the server
  3. Verify the user account is active and not restricted
  4. Check AllowUsers and AllowGroups restrictions
ssh — error
# Attempt login with explicit username
ssh username@hostname
# Or with a specific port if SSH runs on a non-standard port
ssh -p 2222 username@hostname
Failed password for user from hostname port XXXXX ssh2

What this error means

This error appears in the SSH server logs (/var/log/auth.log or /var/log/secure) when someone attempts to log in with a password that doesn't match the stored credentials. Unlike "Failed password for invalid user", this message indicates the username exists but the password is wrong—or the account has restrictions preventing password-based login. The sshd daemon logs all authentication attempts for security auditing. This message is normal during: - Legitimate failed login attempts (typos, wrong user account) - Brute force attacks from remote hosts - Misconfigured authentication settings on the server

Typical symptoms

  • SSH login rejected with 'Permission denied' after entering password
  • Password works on console/local login but fails over SSH
  • Auth logs show 'Failed password for [username]' entries
  • SSH client shows 'Permission denied, please try again' prompt repeating
  • Sudo or other password-based commands work but SSH doesn't

Common causes

  1. Incorrect password entered during SSH login (most common)
  2. Password authentication is disabled in sshd_config (PasswordAuthentication no)
  3. User account is locked, disabled, or expired on the server
  4. User is not in AllowUsers or AllowGroups restriction list in sshd_config
  5. PAM (Pluggable Authentication Modules) authentication is misconfigured
  6. User's shell is set to /bin/false or /usr/sbin/nologin
  7. SSH server is using a different authentication database (LDAP, Active Directory) with sync issues
  8. File system or authentication database has permission problems

How to fix "Failed password for user from hostname port XXXXX ssh2"

1Verify you're using the correct username and password

Double-check your credentials. This is the most common cause. Ensure you:
- Use the correct username (not an email address unless that's the actual username)
- Type the password correctly (watch for caps lock)
- Have the right password for the correct user account

bash
# Attempt login with explicit username
ssh username@hostname
# Or with a specific port if SSH runs on a non-standard port
ssh -p 2222 username@hostname

SSH password entry is completely silent—no asterisks appear as you type, so it's easy to make typos.

2Check if password authentication is enabled on the server

If you have access to the server, verify PasswordAuthentication is enabled:

bash
# Check the SSH server configuration
grep '^PasswordAuthentication' /etc/ssh/sshd_config

If it shows PasswordAuthentication no, password login is disabled. To enable it:

bash
# Edit the SSH config (as root)
sudo nano /etc/ssh/sshd_config

# Find and change this line:
# PasswordAuthentication no
# To:
PasswordAuthentication yes

# Save and exit (Ctrl+X, Y, Enter in nano)

# Restart SSH service
sudo systemctl restart sshd

If you don't have server access, ask your system administrator to enable it.

3Verify the user account is active and not restricted

Check if the user account has login restrictions:

bash
# As root on the server, check account status
sudo chage -l username

Check for:
- Account locked (if output shows "Account locked")
- Password expired
- Account expiration date in the past

If the account is locked:

bash
# Unlock the account
sudo passwd -u username

Also verify the user's shell is not a login shell:

bash
# Check the shell assigned to the user
grep '^username:' /etc/passwd

# If the shell ends with /false or /nologin, change it:
sudo usermod --shell /bin/bash username
4Check AllowUsers and AllowGroups restrictions

SSH may have access control lists that block specific users:

bash
# Check for user/group restrictions
grep -E '^(Allow|Deny)' /etc/ssh/sshd_config

If you see:
- AllowUsers user1 user2 - only those users can login
- AllowGroups groupname - only members of that group can login
- DenyUsers username - that user is explicitly blocked

Add your user to the allowed list:

bash
# Edit the SSH config
sudo nano /etc/ssh/sshd_config

# Add or modify the line:
AllowUsers username

# Or add user to an allowed group:
sudo usermod -a -G sshlogin username

# Update the config:
AllowGroups sshlogin

# Restart SSH
sudo systemctl restart sshd
5Debug with verbose SSH output

Use SSH verbose mode to see exactly where authentication fails:

bash
# Enable maximum verbosity (3 levels)
ssh -vvv username@hostname

# Or for a specific port:
ssh -vvv -p 2222 username@hostname

Look for output like:
- debug1: Authentications that can continue: password - password auth is available
- debug1: Offering password auth - client is sending password
- Authentications that can continue: ... but no "password" - auth method not available

This output helps you identify where the handshake breaks.

6Check SSH server logs for PAM or authentication errors

If basic troubleshooting doesn't work, examine the server logs:

bash
# On Linux/Unix servers, check authentication logs
sudo tail -50 /var/log/auth.log       # Debian/Ubuntu
# Or
sudo tail -50 /var/log/secure         # RHEL/CentOS/Fedora

# Look for these patterns:
# - "pam_unix(sshd:auth): authentication failure; ..."
# - "pam: Authentication failure for [user]"
# - "Invalid user [username]" (username doesn't exist)

These logs reveal whether the failure is password-based or caused by PAM, account restrictions, or other issues.

7If you suspect brute force attacks, enable fail2ban

Repeated failed passwords can indicate brute force attacks. Install fail2ban to block offending IPs:

bash
# Install fail2ban (Debian/Ubuntu)
sudo apt-get install fail2ban

# Or on RHEL/CentOS:
sudo yum install fail2ban

# Start the service
sudo systemctl start fail2ban
sudo systemctl enable fail2ban

# Monitor blocked IPs
sudo fail2ban-client status sshd

For production servers, also consider:
- Disabling password authentication entirely in favor of SSH keys
- Running SSH on a non-standard port
- Using security groups/firewalls to restrict SSH access to known IPs

Advanced notes

Windows OpenSSH Note: On Windows 10/11 with OpenSSH, you must use your online password, not your Windows PIN. If you see "LookupAccountName() failed: 1332" in debug output, this indicates the account mapping failed—ensure you're using the correct account name format (domain\\username for domain accounts).

LDAP/Active Directory: If your organization uses centralized authentication, the password may be correct locally but rejected by the LDAP/AD server. Contact your IT department to verify account status in the directory.

Security Hardening: In production environments, disable password authentication entirely and use SSH keys instead. This eliminates password guessing attacks:

bash
# In /etc/ssh/sshd_config
PasswordAuthentication no
PubkeyAuthentication yes

Frequently asked questions

What does "Failed password for user from hostname port XXXXX ssh2" mean?
log or /var/log/secure) when someone attempts to log in with a password that doesn't match the stored credentials. Unlike "Failed password for invalid user", this message indicates the username exists but the password is wrong—or the account has restrictions preventing password-based login. The sshd daemon logs all authentication attempts for security auditing.
How do I fix "Failed password for user from hostname port XXXXX ssh2"?
SSH authentication failed because the password you entered is incorrect, or the user account doesn't have password authentication enabled. Common causes include wrong credentials, disabled password auth, or account restrictions.
What causes "Failed password for user from hostname port XXXXX ssh2"?
Incorrect password entered during SSH login (most common) Password authentication is disabled in sshd_config (PasswordAuthentication no) User account is locked, disabled, or expired on the server
Is the "Failed password for user from hostname port XXXXX ssh2" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading