Troubleshoot an EC2 SSH connection timeout safely

An SSH client hangs before authentication. Resetting the user password will not fix a connection that cannot reach the instance’s SSH service.

Why this happens

A timeout can result from routing, security groups, network ACLs, an unavailable instance or an inaccessible address. A permission-denied response is a different stage of the connection.

Step-by-step solution

1. Check instance status and confirm the address matches the current instance. Determine whether the intended access path is public, VPN, bastion or a managed session service.

2. Review the relevant route and narrowly scoped inbound rule for the actual client source. Inspect network ACLs and host firewall rules where applicable.

3. If the network path works, check whether the SSH service is running through an available recovery or managed-access channel. Investigate key and username issues only after reaching authentication.

Worked example

A security-group rule limited to yesterday’s office IP can fail after the client network changes. Update the approved source range rather than opening port 22 to the entire internet.

Verify the fix

The connection should reach the intended instance through the approved path. Confirm access remains blocked from sources that are not authorised.

Prevent a repeat

Prefer a documented managed-access approach where suitable and avoid relying on a changing public address as an undocumented operational dependency.

Reference

Official documentation or standards guidance

An original Gistmax troubleshooting guide. Scenarios and sample values are illustrative; configuration depends on your software version and environment. Cover diagram: Gistmax Tutorials.