I can't connect over SSH

What to do when the ssh root@SERVER_IP command or PuTTY can't connect to your server. Find the message you see in the table below: it tells you whether the problem is with the network, the SSH service or authentication. Whatever can be fixed from the panel, you fix on the server card, on the “My Servers” page of the app.blackbox.md panel (app.blackbox.md/my-servers, left menu “Infrastructure” → “My Servers”; from blackbox.md: “Contul meu” (My account) → “Panou de administrare” (Admin panel)).

Available to: the holder of the blackbox.md account that ordered the server. Cards marked “Managed” don't have the panel buttons: write to support.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

Note Customers have no web or VNC console. “Start”, “Stop” and “Reboot” work even without SSH. However, “Reset password”, “Add SSH key”, “Enable password login” and “Disable password login” connect to the server over SSH, on port 22, with the “Management key (blackbox.md)”. They help when your password or key isn't accepted, but not when the server's SSH doesn't respond at all.

What to check first

• The IP address. Copy it from the server card, the “IP” field (the button next to the address shows “Copied”). Don't connect using the domain name: it may not point to the server yet.
• The user is root.
• The port is 22, unless you changed it yourself.
• The login method is shown by the badge next to the server name: “Password + key” or “Key-only”. On a “Key-only” server, the password doesn't work over SSH.
• Is the server new? The “Serverul dvs. este gata — BBX-…” (Your server is ready — BBX-…) email may arrive about a minute before SSH responds. Wait a minute and try again.

The error message, its cause and the fix

“Connection timed out”: the server doesn't respond

The connection doesn't reach the server or gets no response. Check, in this order:

1. The IP. Compare the address in the command with the “IP” field on the card.
2. The server was just created. Wait a minute and try again.
3. The server is stopped. The panel doesn't show whether the server is on or off: the “active” label on the card only means that the server is active in your account. If you stopped it or aren't sure, click “Start” on the card and confirm “Start SERVER_NAME?” with “OK”. Wait a few minutes and try again. The power_action_failed message after “Start” usually means that the server was already running. Details: Rebooting, stopping and starting a server.
4. Your network blocks port 22. Some office networks, hotels and public Wi-Fi networks don't allow SSH. Try from another network, for example over mobile internet. If it works from there, contact the administrator of the original network or see the section about fail2ban.
5. The server's own firewall drops the connection. For example, you enabled ufw or firewalld without allowing port 22. In that case, the panel buttons that use SSH don't work either. Click “Reboot”: it helps only if the rule wasn't saved permanently. Otherwise: Lost access to your server (password or key).

The network filtering managed by BLACKBOX lets SSH through on port 22, so it doesn't block a normal connection: Firewall: network filtering and ufw/firewalld on the server.

“Connection refused”: the server responds, but SSH doesn't accept the connection

The server is on and reachable over the network, but nothing is listening on port 22, or the connection is rejected.

ssh -p PORT root@SERVER_IP

“Permission denied (publickey)”: the key isn't accepted

The server responds, but it accepts only keys, and the key your computer offers isn't among the installed ones.

1. Connect as root. The access details from BLACKBOX are for root, not for other users.

2. Specify the private key explicitly, that is, the file without .pub. If your key file has a different name (for example id_rsa), use that name in the commands below.

   ssh -i ~/.ssh/id_ed25519 root@SERVER_IP

   In PowerShell:

   ssh -i $env:USERPROFILE\.ssh\id_ed25519 root@SERVER_IP

   In PuTTY, you choose the .ppk file under “Connection” → “SSH” → “Auth” → “Credentials”: Connecting to your server over SSH (Windows, macOS, Linux).

3. Check whether the key is on the server. On the card, click “Add SSH key”: the “Installed keys” list appears at the top, with the beginning of each key's fingerprint (for example SHA256:Ab12Cd34Ef56G…). Display your key's fingerprint and compare the beginning:

   ssh-keygen -lf ~/.ssh/id_ed25519.pub

   In PowerShell:

   ssh-keygen -lf $env:USERPROFILE\.ssh\id_ed25519.pub

4. If the key is missing, choose “Paste a new key”, paste the content of the .pub file and click “Add key”. The message “Key added.” appears. If you saved the key in “Contul meu” (My account) → “Chei SSH” (SSH keys), choose “Use a saved key”. With PuTTYgen, copy the text from the “Public key for pasting into OpenSSH authorized_keys file” field: a single line that starts with ssh-ed25519 or ssh-rsa. Details: Adding and removing SSH keys on the server.

5. Connect again.

If you lost your private key or want to log in temporarily with the password (“Enable password login”, then “Reset password”): Lost access to your server (password or key).

If SSH shows WARNING: UNPROTECTED PRIVATE KEY FILE! and ignores the key, the key file's permissions are too broad. On macOS and Linux:

chmod 600 ~/.ssh/id_ed25519

“Permission denied” with a password

The message Permission denied, please try again. appears after each wrong password. After three attempts, SSH closes the connection with Permission denied (publickey,password).

1. On the card, click “Reveal credentials” and confirm “Reveal stored credentials for SERVER_NAME? This access is logged.” A box with “Username” and “Password” appears.
2. Copy the password and paste it when SSH asks for it (in PowerShell and PuTTY, with a right-click). The password doesn't appear on the screen while you type it.
3. If it still doesn't work, you probably changed the password with passwd: the panel shows the password it saved itself, when the server was created or at the last reset. Click “Reset password” and confirm “Reset the password for SERVER_NAME? The current password stops working immediately.” The new password appears in the same box. You can reset the password at most 3 times in 5 minutes: Resetting the root password.

A “Key-only” server doesn't accept passwords over SSH, not even after a reset: SSH doesn't even ask for the password and responds with Permission denied (publickey). Use your key or click “Enable password login”: Enabling and disabling SSH password login.

If you installed fail2ban, several wrong passwords in a row can get your IP address blocked: see the section about fail2ban.

“REMOTE HOST IDENTIFICATION HAS CHANGED”

During an earlier connection, your computer saved a different fingerprint for this IP address: for example, the address previously belonged to another server you connected to, or the system was reinstalled. SSH refuses to connect until you delete the old fingerprint (the command also works in PowerShell):

ssh-keygen -R SERVER_IP

Connect again and confirm the new fingerprint with yes. In PuTTY, in the “PuTTY Security Alert” window, click “Accept”.

Warning If you didn't receive a new server on a previously used IP address and the system wasn't reinstalled, don't continue connecting, and write to support. A fingerprint that changed for no reason may mean that someone is intercepting the connection.

“Too many authentication failures”

The SSH agent on your computer has several keys loaded and offers them one by one. The server closes the connection after a limited number of attempts, before it gets to the right key. Specify a single key:

ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 root@SERVER_IP

On a “Password + key” server, to log in directly with the password without trying the keys:

ssh -o PubkeyAuthentication=no root@SERVER_IP

Your IP address was blocked by fail2ban

This section applies to you if you installed fail2ban on the server. After too many failed logins, fail2ban blocks the IP address they came from: from your network, the connection is refused or times out, but from another network it works.

1. From the blocked network, open https://ip.blackbox.md and note the address shown: this is the blocked address (The “Adresa ta IP” (Your IP address) tool).

2. Connect to the server from another network, for example over mobile internet.

3. Check the addresses blocked for SSH, in the “Banned IP list” line:

   fail2ban-client status sshd

4. Unblock your address:

   fail2ban-client set sshd unbanip YOUR_IP

5. To keep this from happening again, add the address to ignoreip: Protection against password-guessing attempts with fail2ban.

If you don't have another network, wait for the block to expire. Its duration is the bantime value in the fail2ban configuration.

Checks from your computer

Does port 22 respond?

Windows (PowerShell):

Test-NetConnection SERVER_IP -Port 22

TcpTestSucceeded : True means that the port responds and the problem is with authentication. False means that SSH doesn't respond: see the “Connection timed out” and “Connection refused” sections.

macOS and Linux:

nc -vz SERVER_IP 22

A line with succeeded or Connected means that the port responds. Connection refused or timed out means that it doesn't. If the command runs for a long time without a result, the port doesn't respond: stop it with Ctrl + C.

What ssh -v shows

Verbose mode shows each step of the connection:

ssh -v root@SERVER_IP

In PuTTY, the connection details are in the “Event Log”: right-click the window's title bar → “Event Log”.

If you still can't connect

• You lost your password or key, or locked yourself out with the firewall: Lost access to your server (password or key).
• Write to support@blackbox.md from your account's email address, or open a support ticket from “Contul meu” (My account) → “Ajutor și suport” (Help and support). During business hours, you can call +373 78 003948 (phone or WhatsApp), Monday–Friday, 09:00–18:00 (Moldova time). All channels: How to contact BLACKBOX support.

Include in your message:

1. the server's IP address and the BBX-… order number (the “IP” and “Order” fields on the card);
2. your public IP address, from ip.blackbox.md;
3. the exact error message and the time it appeared;
4. the full output of the ssh -v root@SERVER_IP command;
5. what you last changed on the server (firewall, SSH configuration, keys).

Security The ssh -v output contains neither your password nor your private key, so you can send it. Never send the root password, a private key or API tokens.

Frequently asked questions

I could connect yesterday, but not today. Where do I start? Check the port with Test-NetConnection or nc. If the port doesn't respond from any network and you haven't changed anything on the server, click “Reboot”. If you still can't connect after a few minutes, write to support.

“Reboot” doesn't help, and the server doesn't respond at all. “Reboot” sends a normal (soft) reboot, and the panel has no forced-reset button. If the server still doesn't respond after a few minutes, write to support.

On Windows, I get a message that ssh is not recognized. Add the OpenSSH Client component in Windows Settings, under optional features, or use PuTTY: Connecting to your server over SSH (Windows, macOS, Linux).

How do I avoid locking myself out when I change the firewall or the SSH configuration? Keep a second SSH session open until you've checked that a new connection succeeds. Don't set PermitRootLogin no, and don't delete “Management key (blackbox.md)”: otherwise, the panel can no longer help you.