Ubuntu 26.04 LTS – SSH service fails to start after configuration change – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

openssh-server does not start and remote administration is unavailable.

Environment & Reproduction

Issue follows edits in sshd_config, crypto policy changes, or key file permission drift.

systemctl status ssh --no-pager
ss -lntp | grep ':22'
sudo sshd -t
journalctl -u ssh -n 80 --no-pager

Root Cause Analysis

Syntax errors, unsupported directives, or invalid host key permissions cause sshd startup failure.

Quick Triage

Run config validation and inspect recent auth and unit logs.

sudo sshd -t
sudo ls -l /etc/ssh/ssh_host_*
journalctl -xeu ssh --no-pager

Step-by-Step Diagnosis

Check include files and isolate the exact directive triggering parser errors.

grep -R -n '' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf
sudo sshd -T | head -n 40
namei -l /etc/ssh/sshd_config

Solution – Primary Fix

Restore valid config syntax and secure key file permissions before restarting service.

sudo cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
sudoedit /etc/ssh/sshd_config
sudo chmod 600 /etc/ssh/ssh_host_*_key
sudo sshd -t
sudo systemctl restart ssh

Solution – Alternative Approaches

Regenerate host keys if they are corrupted or missing.

sudo rm -f /etc/ssh/ssh_host_*
sudo dpkg-reconfigure openssh-server
sudo systemctl restart ssh

Verification & Acceptance Criteria

Accepted when ssh is active and remote connections authenticate successfully.

systemctl is-active ssh
ss -lntp | grep ':22'
ssh -o BatchMode=yes localhost true

Rollback Plan

Revert to backup configuration if hardened settings prevent service startup.

sudo cp -a /etc/ssh/sshd_config.bak /etc/ssh/sshd_config
sudo systemctl restart ssh

Prevention & Hardening

Always validate config with sshd -t in CI or pre-restart hooks.

sudo sshd -t
sudo systemctl reload ssh
sudo apt install needrestart -y

Related Errors & Cross-Refs

Related errors include bad configuration option, missing privilege separation directory, and host key permissions too open.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

OpenSSH manual pages, Ubuntu security guide, and hardening benchmarks.