SSH Login Denied After Hardening Changes

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

SSH attempts return Permission denied or immediate disconnect.

Environment & Reproduction

Incorrect sshd_config directives, locked account, or wrong key permissions.

Root Cause Analysis

From console, run sshd -t and pw usershow to validate config and account state.

Quick Triage

Re-enable a safe auth path, then restart with service sshd restart.

Step-by-Step Diagnosis

Test daemon syntax using /usr/sbin/sshd -T | head for effective settings.

Solution – Primary Fix

Inspect /etc/ssh/sshd_config and /var/log/auth.log for explicit auth rejection reasons.

Solution – Alternative Approaches

Set valid AllowUsers, PermitRootLogin policy, correct ~/.ssh permissions, and reload sshd.

Verification & Acceptance Criteria

Confirm key-based login works from a trusted host and shell access is stable.

Rollback Plan

Keep an out-of-band console path and test sshd -t before applying changes.

Prevention & Hardening

Restore previous sshd_config from backup and restart service.

Related Errors & Cross-Refs

Escalate if PAM modules or centralized identity providers are rejecting valid users.

Related tutorial: View the step-by-step tutorial for freebsd-15.

View all freebsd-15 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

sshd -t; service sshd restart; pw usershow ; tail -f /var/log/auth.log