SSH access denied after hardening changes

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Administrators cannot log in via SSH, increasing recovery time and outage risk.

Environment & Reproduction

After editing /etc/ssh/sshd_config on RHEL 7, new sessions fail while existing session may remain.

Root Cause Analysis

Invalid sshd syntax, restrictive AllowUsers rules, or firewalld/SELinux blocking port 22.

Quick Triage

Use console access, run sshd -t, and inspect systemctl status sshd.

Step-by-Step Diagnosis

Check journalctl -u sshd -n 200, /var/log/secure, firewalld rules, and SELinux denials with ausearch.

Solution – Primary Fix

Fix sshd_config errors, restore valid access rules, and run systemctl restart sshd after validation.

Solution – Alternative Approaches

Temporarily open alternate management port and revert to known-good config from version control.

Verification & Acceptance Criteria

Key-based login succeeds from approved sources and sshd remains active after restart.

Rollback Plan

Restore previous sshd_config backup and reload sshd from console session.

Prevention & Hardening

Test sshd -t in CI/CD before deployment and keep break-glass console access procedures.

Related Errors & Cross-Refs

Connection refused, Permission denied (publickey), bad configuration option.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

sshd_config man page, RHEL 7 security guide, firewalld and SELinux SSH rules.