NCAE Mapping Hub
Overview Scoreboard Data Roles Exercised Checklists Lessons Skill Drills Practice Terminal Progress
SSH Login failure 2x weight measured

SSH Login. scoring engine cannot TCP-connect to port 22

Failed to connect to host: IP
Events
901
Pts per check
2.8
Pts missed
2,502.8
Teams hit
12/13

Authority mappings

Which work roles, knowledge units, and EWU courses this error pattern touches. Hover for context, click to drill in.

DCWF roles: CE-463 Host Analyst CS-462 Control Systems Security Specialist CS-521 Cyber Defense Infrastructure Support Specialist CS-531 Cyber Defense Incident Responder EN-211 Forensics Analyst IT-411 Technical Support Specialist IT-451 System Administrator
Knowledge Units: CD-BCY Basic Cryptography CD-NDF Network Defense CD-OSA Operating Systems Administration CD-OSC Operating Systems Concepts CD-OSH Operating Systems Hardening
EWU courses: CSCD240-S26 CSCD212 CSCD240 CSCD379 CSCD380 CSCD381 CSCD434 CSCD470 MATH380

What the message means

Plain connection failure: either sshd is down, port 22 isn't forwarded, or something upstream of sshd is dropping the TCP SYN. SSH is **2× weight** (2.78 pts/check) and has been EWU's traditional strength. do not break this during hardening.

Why the service is down

Commands in order

  1. 1. 1. sshd running?
    systemctl status sshd
    Expect
    active (running)
    Interpret and next
    Inactive: `systemctl start sshd`. Failed: `journalctl -u sshd -n 50`. usually a config typo.
  2. 2. 2. Config syntax valid?
    sshd -T 2>&1 | head -20
    Expect
    Configuration output, no errors
    Interpret and next
    Any error = fix it. Common: PermitRootLogin typo, missing file for AllowUsers.
  3. 3. 3. Listening on 22?
    ss -tlnp | grep :22
    Expect
    sshd on 0.0.0.0:22
    Interpret and next
    Listening only on 127.0.0.1 = ListenAddress wrong in sshd_config.
  4. 4. 4. fail2ban has a ban?
    fail2ban-client status sshd 2>/dev/null
    Expect
    Banned IP list; scoring engine's IP must NOT be there
    Interpret and next
    Unban: `fail2ban-client unban <IP>`. Whitelist going forward: `ignoreip` in jail.local.
  5. 5. 5. Host iptables?
    iptables -L INPUT -n | grep -E ':22|dpt:22'
    Expect
    ACCEPT rule (or empty, relying on policy ACCEPT)
    Interpret and next
    DROP/REJECT = `iptables -I INPUT -p tcp --dport 22 -j ACCEPT`.
  6. 6. 6. Scoring user public keys present?
    for u in simone_weil nills todd_k vetomo claude_chevalley; do ls /home/$u/.ssh/authorized_keys 2>/dev/null; done
    Expect
    File exists for each user
    Interpret and next
    Missing: check backup `/root/ssh-keys-backup/`, restore. Scoring users keys MUST be kept.
  7. 7. 7. Router NAT for 22
    /ip firewall nat print where dst-port=22
    Expect
    dstnat TCP 22 -> <server-IP>:22
    Interpret and next
    Missing: add it.

Decision tree

Answer each question to route to the right fix.

Q: Is sshd running and listening on 22?
Yes:
Q: Can you SSH from another machine inside the network?
Yes: Router NAT or ISP-side problem. check NAT first.
No: Host firewall or scoring-user keys missing.
No: Restart or fix config (step 1–3).

External references

Other patterns on this service