How to fix fatal: Cannot bind any address. in SSH

SSHINTERMEDIATECRITICALUpdated Jan 4, 2026· 376 views

The SSH daemon (sshd) fails to start with "fatal: Cannot bind any address" when it cannot listen on the configured address or port. Common causes include address family mismatches, ports already in use, network startup timing issues, and SELinux permission restrictions. Most solutions involve fixing sshd configuration or checking service startup order.

Quick fix

Fixes fatal: Cannot bind any address.

sudo netstat -antp | grep :22
# or with ss (modern systems):
sudo ss -antp | grep :22
  1. Check if sshd is already running
  2. Check what process is using port 22
  3. Fix AddressFamily mismatch
  4. Fix network startup timing (boot issue)
ssh — error
sudo netstat -antp | grep :22
# or with ss (modern systems):
sudo ss -antp | grep :22
fatal: Cannot bind any address.

What this error means

The SSH daemon attempts to bind to one or more addresses when starting (configured via `ListenAddress` directives in `/etc/ssh/sshd_config`). If all configured addresses fail to bind, sshd exits with "fatal: Cannot bind any address." This happens when: - The configured address doesn't exist on the system yet (network not ready at boot) - Another process is already using the port - The address family (IPv4 vs IPv6) is incorrectly configured - SELinux or firewall prevents binding to that port - Permissions prevent sshd from listening on the specified address The error is fatal—sshd will not start at all, making remote SSH access impossible.

Typical symptoms

  • SSH service fails to start on boot or when manually restarted
  • systemctl status ssh shows 'failed' with the error message
  • SSH connections time out or are refused immediately
  • sudo systemctl restart ssh reports 'Job for ssh.service failed'
  • SSH worked before but stopped after reboot or configuration change
  • Error appears in sshd logs: 'fatal: Cannot bind any address'

Common causes

  1. Incorrect AddressFamily in sshd_config (IPv6 set but not available on system)
  2. ListenAddress configured for an IP that doesn't exist or isn't yet assigned at boot
  3. Port 22 (or configured SSH port) already in use by another process or existing sshd instance
  4. sshd starts before network interfaces are fully configured (boot timing issue)
  5. SELinux policy prevents binding to the SSH port (often with non-standard ports)
  6. Firewall or AppArmor policy denies binding to the port
  7. Bridge or virtual interface not ready when sshd tries to bind

How to fix "fatal: Cannot bind any address."

1Check if sshd is already running

First, verify that sshd isn't already listening on the port:

bash
sudo netstat -antp | grep :22
# or with ss (modern systems):
sudo ss -antp | grep :22

Look for LISTEN state on port 22 (or your configured SSH port). If sshd is already running, restart it cleanly:

bash
sudo systemctl stop ssh
sudo systemctl start ssh
sudo systemctl status ssh

If stopping hangs, force it:

bash
sudo pkill -9 sshd
sudo systemctl start ssh
2Check what process is using port 22

If another process is listening on port 22:

bash
sudo lsof -i :22

Or find what's listening on the SSH port:

bash
sudo ss -tlnp | grep :22

If it's an old sshd process that didn't shut down cleanly, kill it:

bash
sudo pkill sshd
# Wait a moment, then restart
sudo systemctl start ssh

If it's a different service, either:
- Change the SSH port in /etc/ssh/sshd_config (set Port 2222, for example)
- Or stop/disable the conflicting service

3Fix AddressFamily mismatch

Open /etc/ssh/sshd_config and check the AddressFamily setting:

bash
sudo nano /etc/ssh/sshd_config

Look for the AddressFamily line. If it's set to inet6 only, change it:

bash
# Old (broken):
AddressFamily inet6

# New (fixed):
AddressFamily any

Or comment it out to use the default (which accepts both IPv4 and IPv6):

bash
# AddressFamily any

Then check the ListenAddress lines. A common mistake is:

bash
# This fails if IPv6 is not fully enabled:
ListenAddress ::

# Better: listen on both
ListenAddress 0.0.0.0
ListenAddress ::

Save and validate the config:

bash
sudo sshd -t

If this shows no errors, restart sshd:

bash
sudo systemctl restart ssh
4Fix network startup timing (boot issue)

If sshd fails only at boot but works after manually restarting, the network isn't ready when sshd starts.

For systemd systems, create an override to make sshd wait for the network:

bash
sudo systemctl edit ssh

Add these lines in the [Unit] section:

bash
[Unit]
After=network-online.target
Wants=network-online.target

Save (Ctrl+X in nano). The file is auto-saved and the service is reloaded.

For init.d systems (older Linux), edit /etc/init.d/ssh or the init script to start sshd after network:

bash
# Look for the start-stop-daemon call and ensure it runs after network initialization
# For OpenRC or similar, you may need to adjust the runlevel or add a dependency

Reboot to verify:

bash
sudo reboot
# After reboot, verify SSH is running
sudo systemctl status ssh
5Fix SELinux permission issues (if applicable)

If you changed the SSH port (non-standard port), SELinux may block binding. Check if SELinux is enabled:

bash
getenforce

If it shows "Enforcing" or "Permissive", you need to allow sshd on your port:

bash
# For a custom port (e.g., 2222):
sudo semanage port -l | grep ssh
# Should show: ssh_port_t = 22

# Add your port:
sudo semanage port -a -t ssh_port_t -p tcp 2222

# Verify:
sudo semanage port -l | grep ssh

Then restart sshd:

bash
sudo systemctl restart ssh

If you don't have semanage, install it:

bash
# On RHEL/CentOS/Fedora:
sudo yum install policycoreutils-python-utils

# On Ubuntu (rarely needed):
sudo apt install selinux-policy-dev
6Fix specific ListenAddress that doesn't exist

If sshd_config has a ListenAddress for an IP that doesn't exist on the system:

bash
sudo nano /etc/ssh/sshd_config

Check all ListenAddress lines:

bash
# Problem: This IP doesn't exist on the system
ListenAddress 192.168.100.50

# Fix: Use a real IP or listen on all
ListenAddress 0.0.0.0         # All IPv4
ListenAddress ::              # All IPv6

To list all IPs on your system:

bash
ip addr show
# or
ifconfig

Update sshd_config to use only IPs that exist, or use 0.0.0.0 and :: to listen on all interfaces.

Test the config:

bash
sudo sshd -t

Restart:

bash
sudo systemctl restart ssh
7Verify the fix

After applying any fix, verify sshd is running and listening:

bash
# Check service status
sudo systemctl status ssh

# Verify it's listening
sudo ss -tlnp | grep ssh
# Should show: tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1234,fd=3))

# Test SSH connection from another machine
ssh -v user@your-server-ip

If SSH still won't start, check the sshd logs for more details:

bash
sudo journalctl -u ssh -n 20
# or
sudo tail -f /var/log/auth.log | grep sshd

Look for specific error messages beyond "Cannot bind any address" to identify the exact cause.

Advanced notes

IPv6 socket handling: If sshd opens an IPv6 socket without the IPV6_V6ONLY flag (or when net.ipv6.bindv6only=0), that socket accepts both IPv4 and IPv6 connections. This can prevent opening a separate IPv4 socket on the same port. Check with sysctl net.ipv6.bindv6only (should be 1 for separate sockets).

Systemd dependency ordering: Modern Linux uses systemd, which starts services in parallel by default. Use After=network-online.target to ensure the network is ready before sshd starts. The default After=network.target is insufficient—network.target fires as soon as networking is configured, not when IPs are assigned.

Multiple ListenAddress lines: sshd can listen on multiple addresses. If *any* address fails to bind, the entire service fails. Ensure all ListenAddress IPs actually exist on the system.

Port privileges: SSH port 22 is privileged (< 1024), requiring sshd to run as root. Custom ports >= 1024 may have different permission requirements. When changing ports, also update firewall rules and SSH client connection strings.

SELinux on non-standard ports: This is a common gotcha. Default SELinux policy only allows ssh_t to bind to port 22. Any custom port requires explicit semanage configuration or disabling SELinux (not recommended).

Frequently asked questions

What does "fatal: Cannot bind any address." mean?
The SSH daemon attempts to bind to one or more addresses when starting (configured via ListenAddress directives in /etc/ssh/sshd_config). " This happens when: - The configured address doesn't exist on the system yet (network not ready at boot) - Another process is already using the port - The address family (IPv4 vs IPv6) is incorrectly configured - SELinux or firewall prevents binding to that port - Permissions prevent sshd from listening on the specified address The error is fatal—sshd will not start at all, making remote SSH access impossible.
How do I fix "fatal: Cannot bind any address."?
The SSH daemon (sshd) fails to start with "fatal: Cannot bind any address" when it cannot listen on the configured address or port. Common causes include address family mismatches, ports already in use, network startup timing issues, and SELinux permission restrictions. Most solutions involve fixing sshd configuration or checking service startup order.
What causes "fatal: Cannot bind any address."?
Incorrect AddressFamily in sshd_config (IPv6 set but not available on system) ListenAddress configured for an IP that doesn't exist or isn't yet assigned at boot Port 22 (or configured SSH port) already in use by another process or existing sshd instance
Is the "fatal: Cannot bind any address." error serious?
Yes. This is a critical-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading