ssh: connect to host x.x.x.x port 22: Connection refused (New Instance from AMI)

Question

Hi, I have created a new EC2 instance from AMI but at the first connection attempt I get the error message:

*ssh: connect to host x.x.x.x port 22: Connection refused*

The instance was created from a custom AMI of a working EC2 instance with RHEL8 OS in order to use the same features of the services already configured on the instance. I have created different AMIs from the same EC2 instance and the problem is the same. I have also created other EC2 instances from a custom AMI of another server with RHEL8, and I get the same problem. It is worth mentioning that I perform the same procedure of creating EC2 instances from custom AMIs with Amazon Linux and Ubuntu operating system, and in these instances I manage to connect via ssh on the first try. So I assume that the problem has to do with the RHEL OS.

After verifying the port through telnet I get:

*Trying x.x.x.x...*

*telnet: connect to address x.x.x.x: Connection refused*

If I run the ping command to the public IP of the EC2 interface I receive the correct response

*ping x.x.x.x*

*PING x.x.x.x (x.x.x.x) 56(84) bytes of data.*

*64 bytes from x.x.x.x: icmp_seq=1 ttl=64 time=0.710 ms*

*64 bytes from x.x.x.x: icmp_seq=2 ttl=64 time=0.589 ms*

*64 bytes from x.x.x.x: icmp_seq=3 ttl=64 time=1.06 ms*

*64 bytes from x.x.x.x: icmp_seq=4 ttl=64 time=0.675 ms*

*^C*

*--- 10.0.0.250 ping statistics ---*

*4 packets transmitted, 4 received, 0% packet loss, time 3059ms*

*rtt min/avg/max/mdev = 0.589/0.758/1.061/0.183 ms*

I've already checked all these things and I'm getting the same error:

* Restart the EC2 instance from the AWS console
* I tried to connect to the EC2 instance by Public IPv4 DNS, Private IP DNS name, Private IPv4 addresses, Public IPv4 address
* I've configured a Public Elastic IP
* The EC2 instance is in a public subnet, and a subnet that has an entry in its routing table to an Internet gateway
* The EC2 instance is in the same security group as the source EC2 instance that allows inbound access on TCP port 22
* I've also configured a security group that allows all inbound and outbound network traffic
* Verify the absence of a network ACL associated with the subnet that denies inbound access on TCP port 22

Thank you very much in advance

Didier Durand · Answer

Hi,

The right way to do that initially to use Instance Connect to connect to your instance from the AWS console: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-methods.html

In case you've problems with Instance Connect, this KC article will help you: https://repost.aws/knowledge-center/ec2-instance-connect-troubleshooting

When you get the IC use case to work, it will be easy to switch to regular ssh from your laptop.

Best,

Didier

re:Post Agent · Answer

Based on the information provided, it appears that you're experiencing a connection issue specifically with RHEL 8 instances created from custom AMIs. Since you've already verified many common network and security configurations, the problem likely lies within the instance itself. Here are some potential causes and solutions to consider:

1. SSH service not running: When creating an AMI, sometimes the SSH service may not start automatically on the new instance. You can try to start the SSH service manually by accessing the instance through the EC2 console's "Get System Log" feature or by using EC2 Instance Connect (if available).

2. Firewall settings: RHEL 8 uses firewalld by default, which might be blocking incoming SSH connections. The firewall configuration from the source instance may have carried over to the new instance. You may need to adjust the firewall rules to allow SSH traffic.

3. SELinux: If SELinux is enabled and configured incorrectly, it could prevent SSH connections. You might need to check and adjust SELinux settings.

4. SSH configuration: The sshd_config file might have settings that are preventing connections. Check if there are any restrictive configurations in this file.

5. Network interface configuration: Ensure that the network interface is properly configured and that the IP address is correctly assigned to the instance.

6. Instance metadata: Make sure the instance can access the EC2 instance metadata service, as this is crucial for proper functioning of many AWS services.

To troubleshoot these issues, you may need to use EC2 Instance Connect (if available for your RHEL 8 AMI) or attach the root volume to another instance to investigate and fix the configuration.

If none of these solutions work, you might want to consider creating a new AMI from your RHEL 8 instance after ensuring that SSH is properly configured and all necessary services are running. This new AMI should then allow SSH connections when launching new instances.

Remember to also check the EC2 instance's system log for any error messages or indications of what might be preventing the SSH service from starting or accepting connections.  
**Sources**  
[Tutorial: Complete the configuration required to connect to your instance using EC2 Instance Connect - Amazon Elastic Compute Cloud](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-tutorial.html)  
[Connect to an Amazon EC2 instance using EC2 Instance Connect Endpoint - Amazon Elastic Compute Cloud](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-using-eice.html)  
[Troubleshoot issues connecting to your Amazon EC2 Linux instance - Amazon Elastic Compute Cloud](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesConnecting.html)  
[AWSSupport-TroubleshootEC2InstanceConnect - AWS Systems Manager Automation runbook reference](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-troubleshoot-ec2-instance-connect.html)

Bach Doan Vuong · Answer

Using **`ping`** to check whether port 22 is open on a virtual machine is **not appropriate**, because:

1. **`ping` does not check ports**:
   - `ping` uses the **ICMP protocol**, not **TCP/UDP**, and does not interact with any specific port like port 22.
   - A machine may respond to **ICMP Echo Requests (ping)**, but port 22 (or other ports) could still be closed.

2. **ICMP can be blocked**:
   - If a firewall blocks ICMP traffic, you won't get a response to `ping`, but that doesn't mean port 22 is closed.

---

### **More Effective Solutions:**

To check whether **port 22 (SSH)** is open, use tools that work directly with **TCP/UDP protocols**, such as:

1. **`telnet`**:
   ```bash
   telnet  22
   ```
   - If the connection succeeds, port 22 is open.
   - If it fails, port 22 may be closed or blocked.

2. **`nc` (Netcat)**:
   ```bash
   nc -zv  22
   ```
   - The `-z` option checks the port without sending data, and `-v` displays verbose output.

3. **`nmap`**:
   ```bash
   nmap -p 22 
   ```
   - This tool can determine the port's status (open/closed/filtered) and whether it is blocked by a firewall.

ssh: connect to host x.x.x.x port 22: Connection refused (New Instance from AMI)

More Effective Solutions:

Add your answer

Relevant content