Introduction

SSH is commonly used to connect to Linux-based Amazon EC2 instances for server administration and troubleshooting.

Sometimes an EC2 instance may be running normally. However, the SSH connection can still fail due to issues with the Security Group, Network ACL, route table, SSH service, key permissions, or instance configuration.

In this article, we will look at some common SSH connection issues in AWS EC2 and the steps to troubleshoot them.

Prerequisites

Before proceeding, ensure you have:

  • An AWS account
  • A running EC2 Linux instance
  • The EC2 instance public IP address or DNS name
  • The correct SSH private key (.pem)
  • Access to the AWS Management Console
  • Basic knowledge of Linux and SSH

Implementation

Step 1: Check the EC2 Instance Status

First, log in to the AWS Management Console and navigate to:

EC2 → Instances

Check the following:

  • Instance state should be Running
  • Status checks should show 2/2 checks passed
  • Verify the Public IPv4 address
  • Verify the Public IPv4 DNS

If the instance is stopped, start the instance and wait for the status checks to complete.

Step 2: Check the Security Group

One of the most common causes of SSH connection failure is a missing or incorrect Security Group rule.

Go to:

EC2 → Instances → Select Instance → Security

Open the associated Security Group and check the inbound rules.

Make sure TCP port 22 is allowed from your IP address.

Example:

Type:       SSH
Protocol:   TCP
Port:       22
Source:     <Your-Public-IP>/32

For example:

SSH    TCP    22    203.0.113.10/32

For testing purposes, you may temporarily allow SSH from a wider source, but restricting SSH access to your IP address is recommended.

Step 3: Check the Network ACL

If the Security Group is configured correctly but SSH is still not working, check the Network ACL associated with the subnet.

Go to:

VPC → Subnets → Select Subnet → Network ACL

Make sure the Network ACL allows the required traffic.

For SSH, verify that:

  • Inbound TCP port 22 is allowed.
  • Return traffic is allowed through the appropriate ephemeral ports.
  • Outbound traffic is not being blocked.

Step 4: Check the Route Table

The EC2 instance must have a valid network route to the internet if you are connecting through its public IP.

Go to:

VPC → Route Tables

Check the route table associated with the subnet.

A typical public subnet should have a route similar to:

Destination     Target
0.0.0.0/0       Internet Gateway

If there is no route to an Internet Gateway, the instance may not be reachable directly from the internet.

Step 5: Check the Instance Public IP

Verify that the EC2 instance has a public IPv4 address.

From the AWS Console:

EC2 → Instances → Select Instance

Check:

Public IPv4 address

If the instance does not have a public IP address, direct SSH access from the internet will not work.

In a private subnet, you normally need another access method, such as a bastion host, VPN, or AWS Systems Manager Session Manager.

Step 6: Check the SSH Key Permissions

When using a .pem key from Linux or macOS, make sure the private key has the correct permissions.

Run:

chmod 400 your-key.pem

Then connect using:

ssh -i your-key.pem ubuntu@<EC2-Public-IP>

For an Amazon Linux instance, the default user may be:

ssh -i your-key.pem ec2-user@<EC2-Public-IP>

The username depends on the operating system image used to launch the EC2 instance.

Step 7: Test the SSH Port

You can check whether port 22 is reachable from your local system.

Using nc:

nc -vz <EC2-Public-IP> 22

Or using telnet:

telnet <EC2-Public-IP> 22

If the connection is successful, you should see that port 22 is reachable.

If the connection times out, check the Security Group, Network ACL, route table, public IP, and firewall configuration.

Step 8: Check the SSH Service

If you have console access to the instance through another method, check whether the SSH service is running.

For Ubuntu:

systemctl status ssh

If it is not running:

systemctl start ssh

Enable it at boot:

systemctl enable ssh

For systems using sshd:

systemctl status sshd

Step 9: Check the Server Firewall

The operating system firewall may also block SSH connections.

For Ubuntu systems using UFW:

ufw status

If SSH is not allowed, add the SSH rule:

ufw allow 22/tcp

Then check the firewall status again:

ufw status

If you are using another firewall such as iptables or firewalld, check its rules as well.

Step 10: Use Verbose SSH Output

If you are still unable to connect, use SSH verbose mode:

ssh -vvv -i your-key.pem ubuntu@<EC2-Public-IP>

The -vvv option provides detailed information about the SSH connection.

It can help identify whether the issue is related to:

  • Network connectivity
  • Authentication
  • Private key
  • SSH configuration
  • Host verification
  • Server response

Common SSH Errors

Connection Timed Out

Example:

ssh: connect to host <IP> port 22: Connection timed out

Check:

  • Security Group
  • Network ACL
  • Route table
  • Internet Gateway
  • Public IP
  • Server firewall

Connection Refused

Example:

ssh: connect to host <IP> port 22: Connection refused

This generally means the server is reachable, but nothing is accepting connections on port 22.

Check the SSH service:

systemctl status ssh

Also verify that SSH is listening:

ss -lntp | grep :22

Permission Denied

Example:

Permission denied (publickey).

Check:

  • SSH username
  • .pem file
  • Private key permissions
  • Correct key pair
  • authorized_keys on the server

Make sure the key permissions are restricted:

chmod 400 your-key.pem

Verification

After making the required changes, try connecting again:

ssh -i your-key.pem ubuntu@<EC2-Public-IP>

If the connection is successful, you should receive the server’s shell prompt.

For example:

ubuntu@ip-10-0-1-10:~$

You have successfully connected to the EC2 instance.

Conclusion

SSH connection problems in AWS EC2 can occur at different levels, including AWS networking, Security Groups, Network ACLs, operating system firewalls, SSH configuration, and authentication.

A systematic approach makes troubleshooting easier:

  1. Check the EC2 instance status.
  2. Verify the Security Group.
  3. Check the Network ACL.
  4. Verify the route table and Internet Gateway.
  5. Check the public IP.
  6. Verify the SSH key and username.
  7. Check the SSH service.
  8. Check the server firewall.
  9. Use ssh -vvv for detailed troubleshooting.

Following these steps can help identify and resolve most common SSH connectivity issues with Linux-based EC2 instances.

FAQ

1. Why can’t I connect to my EC2 instance using SSH?

The most common reasons are an incorrect Security Group rule, blocked port 22, missing public IP, incorrect route table, server firewall, stopped SSH service, or an incorrect SSH key or username.

2. Why am I getting “Connection timed out”?

A timeout usually indicates a network connectivity issue. Check the Security Group, Network ACL, route table, Internet Gateway, public IP address, and firewall.

3. Why am I getting “Connection refused”?

This usually means the EC2 instance is reachable, but the SSH service is not accepting connections.

Related Articles

How to Enable Multi-Factor Authentication (MFA) for an AWS IAM User

How to Create an AWS EC2 Instance Using Terraform in Ubuntu

HOW TO CREATE AN IAM (Identity and Access Management) USER IN AWS CONSOLE

Post Views: 0

Leave a Reply