SSH :connect to host localhost port 22: Connection refused

In debian kali I tried to connect ssh and getting the following error :

SSH: connect to host localhost port 22: Connection refused

Background :

I was trying to connect ssh in debian, I am using kali 2.0 sana

What I have tried/did:

`apt-get install openssh-server`

installed openssh-server and its uptodate

Queried service ssh status

● ssh.service - OpenBSD Secure Shell server
   Loaded: loaded (/lib/systemd/system/ssh.service; enabled)
   Active: active (running) since Wed 2015-09-23 17:20:36 IST; 36min ago
 Main PID: 1594 (sshd)
   CGroup: /system.slice/ssh.service
           └─1594 /usr/sbin/sshd -D

Reconfigured dpkg-reconfigure openssh-server and it also lead to success

Now I tried to connect ssh root@localhost which requires root@localhost password so what I did was

vi /etc/ssh/sshd_config and added command to deny root login :

My sshd_config as follows :

What ports, IPs and protocols we listen for Port 22
#Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0 Protocol 2
# HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security UsePrivilegeSeparation yes

Now again tried to connect ssh via ´ssh root@localhost´ not I got connect to host localhost port 22: Connection refused

I though my iptables might be preventing it so configured it as :

vim /root/firewall.rules
root@vignesh:~# iptables-save > /root/firewall.rules
root@vignesh:~# iptables -X
root@vignesh:~# iptables -t nat -F
root@vignesh:~# iptables -t nat -X
root@vignesh:~# iptables -t mangle -F
root@vignesh:~# iptables -t mangle -X
root@vignesh:~# iptables -P INPUT ACCEPT
root@vignesh:~# iptables -P FORWARD ACCEPT
root@vignesh:~# iptables -P OUTPUT ACCEPT
root@vignesh:~# iptables-save > /root/firewall.rules

And I queried the iptables-save

# Generated by iptables-save v1.4.21 on Wed Sep 23 18:50:34 2015
*mangle
:PREROUTING ACCEPT [41217:4171959]
:INPUT ACCEPT [27727:3255690]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1834:219528]
:POSTROUTING ACCEPT [1835:219654]
COMMIT
# Completed on Wed Sep 23 18:50:34 2015
# Generated by iptables-save v1.4.21 on Wed Sep 23 18:50:34 2015
*nat
:PREROUTING ACCEPT [15456:1179155]
:INPUT ACCEPT [1858:255303]
:OUTPUT ACCEPT [223:14078]
:POSTROUTING ACCEPT [223:14078]
COMMIT
# Completed on Wed Sep 23 18:50:34 2015
# Generated by iptables-save v1.4.21 on Wed Sep 23 18:50:34 2015
*filter
:INPUT ACCEPT [26756:3173280]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1775:215770]
COMMIT

As per comment checked

root@vignesh:~# netstat -an | grep 22
tcp        0      0 10.100.8.40:54036       216.58.220.46:80        ESTABLISHED
tcp        0      0 10.100.8.40:41573       216.58.220.14:80        ESTABLISHED
unix  3      [ ]         STREAM     CONNECTED     17722    @/tmp/dbus-JUNz9GwSon
unix  3      [ ]         STREAM     CONNECTED     13422    
unix  3      [ ]         STREAM     CONNECTED     17224    
unix  3      [ ]         STREAM     CONNECTED     17422    
unix  2      [ ]         DGRAM                    9222     
unix  3      [ ]         STREAM     CONNECTED     17221    /var/run/NetworkManager/private
unix  3      [ ]         STREAM     CONNECTED     17225    /var/run/NetworkManager/private
unix  3      [ ]         STREAM     CONNECTED     17229    
unix  3      [ ]         STREAM     CONNECTED     17220

Now again I tried ssh root@localhost but again got the error.

Kindly guide me where I am missing the part? How can I get it connected?

BlueBerry - Vignesh4303

Posted 2015-09-23T13:36:05.950

Reputation: 7 221

Do you mind trying with a non-root user and telling what happens? Also is your sshd file just those lines? Try to add: "PermitRootLogin yes" – SOMN – 2015-09-23T13:58:10.290

Could you run "netstat -an | grep 22" and edit your question to include the output? – Kenster – 2015-09-23T14:10:23.723

@Glaudio yes bro i already tried it but connection refused for the same – BlueBerry - Vignesh4303 – 2015-09-24T03:44:06.153

@kenster added output of it bro – BlueBerry - Vignesh4303 – 2015-09-24T03:46:50.690

Your post shows garbage in your sshd_config file. – David Schwartz – 2015-09-30T13:18:50.913

@DavidSchwartz sorry friend completely noob at this stuff,what do u mean by garbage in my sshd_config file ,what i need to do if i find garbage over there,how can i resolve it friend :) – BlueBerry - Vignesh4303 – 2015-09-30T13:21:34.473

2Look at your own post. Look at the beginning of the sshd_config. Maybe that's not really in the file, but if it is, that's a problem. – David Schwartz – 2015-09-30T13:22:18.447

Is your entire sshd_config commented out? Here is an example of what it should look like (your data above has all the line jumbled together):

https://gist.github.com/wwalker/089b22fce0fd962f1d50

You show the commentary uncommented and the directives commented out.

The file looks terrible, if that is just a pasting error, and the file is good, then try this and post it here:

sudo lsof -nn | grep sshd | grep TCP | grep LISTEN

My guess is that it is listening on a different port.

– Wayne Walker – 2015-10-01T02:53:56.403

Answers

Your netstat output shows that there's no process listening to port 22, and that would explain why you get a Connection refused when trying to SSH.

Your status info about the sshd daemon shows running, however no listening port is associated with it (or doesn't seem to).

Further, as you were told in the comments, your sshd_config file seem to be incorrect. You say you want to disable root login, so I'll propose a configuration for your SSH daemon.

Edit the /etc/ssh/sshd_config file and put the following content in it:

Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 1024
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 120
PermitRootLogin no
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
UsePAM yes
ClientAliveInterval 30
ClientAliveCountMax 99999

If you're worried about security, you can restrict SSH only to the users you want. For example, if you want to restrict that only user vignesh can SSH, you can add another directive like this:

AllowUsers vignesh

After that, simply restart the sshd service. Once done, if you run netstat -atpn | grep 22 you should see the port 22 listening for everybody.

nKn

Posted 2015-09-23T13:36:05.950

Reputation: 4 960

This should work. Although, the sample sshd_config may be longer than needed for the answer. Just make sure it specifies "Port 22". Or, you could override via a command line, which might be simpler for basic testing. Just run: " $( which sshd ) -p 22 " (without the quotes). (Add "sudo" before that command line, if needed.) – TOOGAM – 2015-10-02T19:56:22.277

Indeed, this is more than needed, I just put it all because it is a "standard" SSH configuration and additionally included the security measures that the OP requested; but you're right, normally the Port directive should be enough for it to work. – nKn – 2015-10-02T20:09:42.010

I can't see if you actually added this line, or uncommented it: Port 22

If no port is specified in sshd_config, sshd will not listen on any port. Given your output from netstat, this is likely the issue.

Jasper Kips

Posted 2015-09-23T13:36:05.950

Reputation: 31

The "grammar fix" was severe, but seems to be within spirit. OpenBSD man page for sshd_config is authoritative (since OpenBSD project releases OpenSSH and Portable OpenSSH). The man page says "The default is 22." I'm a tad busy at the moment to be bothering to test this to verify, but I think this info ("sshd will not listen on any port.") is incorrect.

– TOOGAM – 2015-10-02T19:54:38.173

Yes, the default is 22, however, try removing the Port entry from sshd_config, and then see what port sshd listens on with netstat. – Jasper Kips – 2015-10-02T20:32:27.780

I tested it by the way before writing the answer. On Ubuntu sshd actually doesn't listen on any port, connecting is impossible, yet the status of the daemon is as the author of the question indicates. – Jasper Kips – 2015-10-02T20:39:27.287

First of make sure your root account has set up with password if root has no password you can sudo passwd root then type new password for root.

Then you can SSH in with the -v option for verbose output.:

ssh root@localhost -v

If the connection is still refused, please post the output of the ssh root@localhost -v command.

ji-ruh

Posted 2015-09-23T13:36:05.950

Reputation: 141

Steps:

Let's suppose the IP of server 1 is 192.x.x.1 and the IP of server 2 is 192.x.x.2

On server 1:

ssh-keygen -t rsa
cd .ssh
ssh-copy-id -i /root/.ssh/id_rsa.pub root@192.x.x.2

Now ssh server2.com or ssh 192.x.x.2

If you get a connection error (SSH ::), then check the /etc/hosts file on both servers it must have IP's of SERVER1 and SERVER2 and if it doesn't contain entries of both servers then update this /etc/hosts file on both servers having IP address hostname etc, and then check if your issue will be resolved.

I got the same error and it is resolved by modifying IP's in both hosts files.

Maroof khan

Posted 2015-09-23T13:36:05.950

Reputation: 1

OP is trying to connect to localhost, not another server; and the issue is that the connection is refused, not the name lookup failed. – bertieb – 2017-04-27T10:30:09.943

Even with this edit, it still does not address the question (OP has no ssh service running!), which has an accepted answer. – bertieb – 2017-04-27T10:46:55.150

It occurred to me today. According to this link, "Kali Linux does not come with SSH enabled"

CodyChan

Posted 2015-09-23T13:36:05.950

Reputation: 469