my Linux server can be pinged but cannot be connected-Simple Application Server(SAS)-阿里云帮助中心

Your Linux Simple Application Server responds to ping but refuses SSH connections. This guide covers the most common causes and how to fix each one.

Quick diagnostics

Before troubleshooting in detail, rule out the basics:

Confirm that your local network works by pinging a public address such as 8.8.8.8.
Verify that you are connecting to the correct IP address and port.
Run SSH with verbose output to identify the failure stage: The verbose log shows where the connection breaks -- DNS resolution, TCP handshake, or authentication -- so you can jump to the right solution below.
```
   ssh -v root@<your-server-ip>
```

Causes

Category	Typical symptom
Invalid password	`Permission denied` after entering credentials
Invalid SSH service configuration	`Connection refused` on port 22
SSH configuration blocking access	`Permission denied` even with the correct password
Firewall blocking port 22	`Connection timed out` or no response on port 22

Reset the server password

If SSH prompts for a password but rejects it, the password may be incorrect or expired.

Change the password from the Simple Application Server console. For detailed steps, see Set or reset the password of a server.

Verify the SSH service

If the SSH daemon is not running or is listening on the wrong interface, connections are refused even though the server responds to ping.

Connect to the server by using the rescue feature. For detailed steps, see Connect to a Linux server by using the rescue feature.
Check whether the SSH service is listening on port 22: SSH is running -- the output shows sshd listening on 0.0.0.0:22: SSH is not running -- no output is returned, or the output does not include port 22.
```
   netstat -lntup | grep 22
```
```
   tcp   0   0 0.0.0.0:22   0.0.0.0:*   LISTEN   <pid>/sshd
```
If SSH is not listening, start or restart the service: Then run the netstat command again to confirm that port 22 is now active.
```
   systemctl start sshd
```

Fix SSH configuration issues

Certain settings in /etc/ssh/sshd_config can block remote access even when the service is running. Common examples:

PermitRootLogin no -- prevents root from logging on through SSH.
AllowUsers or DenyUsers directives -- restricts which users can log on.
ListenAddress 127.0.0.1 -- limits SSH to local connections only.

To fix these issues:

Connect to the server by using the rescue feature. For detailed steps, see Connect to a Linux server by using the rescue feature.
Open the SSH configuration file:
```
   vi /etc/ssh/sshd_config
```
Update or comment out any directives that block access. For example, to allow root logon with a password, change: to:
```
   PermitRootLogin no
```
```
   PermitRootLogin yes
```
Save the file and restart the SSH service:
```
   systemctl restart sshd
```

For a detailed walkthrough, see the "Deny logons by the root user" section in What do I do if the "Permission denied, please try again" error message appears when I log on to a Linux instance as the root user by using SSH?

Open SSH port 22 on the firewall

A firewall that blocks port 22 prevents SSH connections while still allowing ping (ICMP) traffic. Check both the OS-level firewall and the cloud-level firewall rules in the Simple Application Server console.

Check the OS-level firewall

Connect to the server by using the rescue feature. For detailed steps, see Connect to a Linux server by using the rescue feature.
Check whether port 22 is allowed through the firewall. The command depends on which firewall tool your Linux distribution uses. FirewallD (CentOS, Alibaba Cloud Linux): If the output is no, port 22 is blocked. Open it: Alternatively, stop the firewall entirely: UFW (Ubuntu, Debian): If port 22 is not listed or the action is DENY, allow it:
```
   firewall-cmd --permanent --add-port=22/tcp
   firewall-cmd --reload
```
```
   ufw status
```
```
   ufw allow 22/tcp
```

Check the cloud-level firewall rules

The Simple Application Server console has its own firewall rules that control inbound traffic independently of the OS firewall. Even if the OS firewall allows port 22, the cloud-level rules must also permit SSH traffic.

Log on to the Simple Application Server console.
Navigate to your server and open the Firewall tab.
Confirm that a rule exists to allow TCP port 22 for inbound traffic. If no such rule exists, add one.

References

For more solutions to remote connection failures on Linux servers, see FAQ.