> ## Documentation Index
> Fetch the complete documentation index at: https://docs.digitalfyre.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Locked Out of SSH

If you cannot connect to your VPS via SSH, the cause is typically a wrong password, SSH service not running, a firewall blocking port 22, or a network configuration issue. The VNC console is your primary recovery tool in all cases.

## Diagnose the Problem

Run SSH with verbose output to see where the connection fails:

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
ssh -v root@YOUR_SERVER_IP
```

| Error                  | Likely Cause                                       |
| ---------------------- | -------------------------------------------------- |
| `Connection refused`   | SSH is not running or firewall is blocking port 22 |
| `Connection timed out` | Firewall dropping packets or server is down        |
| `Permission denied`    | Wrong password or SSH key mismatch                 |
| `No route to host`     | Network issue or server is down                    |

## Recovering via VNC

Open the [VNC Console](/vps/client-portal/vnc-console) from your service page and log in with your root credentials.

### Wrong Password

Reset your root password from the [Client Portal](/vps/client-portal/password-resets), then try SSH again. Alternatively, log in via VNC and run:

```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
passwd
```

### SSH Service Not Running

```bash expandable lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
# Check status
systemctl status sshd

# Start if stopped
systemctl start sshd

# Enable on boot
systemctl enable sshd

# Check for config errors if it won't start
sshd -t
```

Fix any errors reported in `/etc/ssh/sshd_config`, then start the service again.

### Firewall Blocking SSH

<Tabs>
  <Tab title="iptables">
    ```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
    iptables -I INPUT -p tcp --dport 22 -j ACCEPT
    ```
  </Tab>

  <Tab title="firewalld (RHEL-based)">
    ```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
    firewall-cmd --permanent --add-service=ssh
    firewall-cmd --reload
    ```
  </Tab>

  <Tab title="ufw (Ubuntu)">
    ```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
    ufw allow ssh
    ```
  </Tab>
</Tabs>

### SSH Key Lockout

If you disabled password authentication and your key no longer works:

<Steps>
  <Step title="Log In via VNC">
    Open the [VNC Console](/vps/client-portal/vnc-console) and log in with your root password.
  </Step>

  <Step title="Re-enable Password Authentication Temporarily">
    ```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
    nano /etc/ssh/sshd_config
    ```

    Set `PasswordAuthentication yes`, then restart SSH:

    ```bash lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
    systemctl restart sshd
    ```
  </Step>

  <Step title="Fix Your SSH Key">
    Connect via SSH using your password, resolve your key configuration, then re-disable password authentication once key access is confirmed.
  </Step>
</Steps>

### Network Configuration Broken

If the server has no network connectivity:

```bash expandable lines theme={"theme":{"light":"light-plus","dark":"ayu-dark"}}
# Check if the interface has an IP
ip addr show

# Check the default route
ip route show

# Restart networking
systemctl restart networking       # Debian / Ubuntu
systemctl restart NetworkManager   # RHEL-based
```

If the configuration is beyond repair, [restore from a backup](/vps/virtfusion/backup-management).

## Prevention

* Always test SSH after making firewall or SSH configuration changes — do this before closing your existing session
* Keep password authentication enabled as a fallback until key-based login is confirmed working
* Maintain a recent backup before making network or SSH configuration changes