How to fix refused connect from hostname in SSH

First, verify that sshd is properly running and listening:

sudo systemctl status sshd

If the status shows 'active (running)', restart it:

sudo systemctl restart sshd

Then immediately test your connection again. Sometimes sshd can appear to be running but has a stale state.

TCP Wrappers is a common cause of 'refused connect' messages. Check both configuration files:

sudo cat /etc/hosts.deny
sudo cat /etc/hosts.allow

Look for any lines containing 'sshd' or 'ALL'. If you see sshd: ALL in hosts.deny, that's blocking all SSH connections. Remove or comment out such lines.

To explicitly allow SSH from your client IP, add to /etc/hosts.allow:

sudo echo 'sshd: 192.168.1.100' >> /etc/hosts.allow

Replace 192.168.1.100 with your actual client IP address.

Identify what IP address or hostname the client is connecting from. Check the server logs:

sudo tail -f /var/log/auth.log

Or on some systems:

sudo tail -f /var/log/secure

Look for the 'refused connect from' line. Note the IP address shown. This is the address you need to allow in TCP Wrappers or firewall rules.

Verify that your firewall isn't blocking port 22:

sudo iptables -L -n | grep 22

Or for firewalld:

sudo firewall-cmd --list-all | grep ssh

If port 22 is blocked, allow it:

With iptables:

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

With firewalld:

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

Check your SSH daemon configuration for any explicit restrictions:

sudo cat /etc/ssh/sshd_config | grep -i 'allow\|deny'

Look for directives like AllowUsers, DenyUsers, AllowGroups, or DenyGroups. If your user or IP is in a deny list, remove it or add yourself to the allow list.

Also check for Protocol, ListenAddress, or Port misconfigurations. If sshd is not listening on the correct interface or port, connections will be refused.

If you have Fail2Ban installed, it might be blocking your IP:

sudo fail2ban-client status sshd

If your IP is in the banned list, unban it:

sudo fail2ban-client set sshd unbanip 192.168.1.100

Replace 192.168.1.100 with your actual IP address.

Once changes are made, test with verbose SSH output to confirm the connection:

ssh -vvv user@hostname

This will show detailed logs of where the connection is failing. Look for 'refused' messages and use them to identify which component (TCP Wrappers, firewall, sshd config) is causing the rejection.