How to Fix Rsync SSH Connection Refused on a Custom Port

When using rsync to synchronize files over SSH, encountering a “connection refused” error can halt your workflow, especially if your SSH server runs on a custom port. This guide walks you through diagnosing and fixing this common issue, ensuring your rsync commands work smoothly over your desired SSH port.

What You’ll Need

Access to both the local and remote machines involved
Knowledge of the SSH custom port number configured on the remote server
Basic familiarity with command-line tools and editing configuration files
Administrative or sudo privileges on the remote server to check firewall and SSH settings

Step-by-Step

Confirm the SSH Custom Port
Verify the SSH server on the remote machine is configured to listen on your intended custom port. Connect to the remote server via a terminal or console and check /etc/ssh/sshd_config for the line Port <custom-port>. For example:
```
sudo grep ^Port /etc/ssh/sshd_config
```
This shows the port SSH listens on.
Ensure SSH Server Is Running
Check that the SSH daemon is active and listening on the custom port:
```
sudo systemctl status sshd
```
or
```
sudo service ssh status
```
Then verify the port listening with:
```
sudo netstat -tulnp | grep <custom-port>
```
or
```
ss -tuln | grep <custom-port>
```
Test SSH Connection Manually
From your local machine, test connecting to the remote server on the custom port using:
```
ssh -p <custom-port> user@remote_host
```
If this fails with “Connection refused,” the issue is not specific to rsync but the SSH connection itself.
Specify the Custom Port in Rsync Command
Ensure your rsync command explicitly uses the custom SSH port. Use the -e flag to specify SSH options:
```
rsync -avz -e "ssh -p <custom-port>" /local/path user@remote_host:/remote/path
```
Without this, rsync attempts to connect over the default port 22 and will fail.
Check Firewall Settings on Remote Server
Confirm that the remote server’s firewall allows inbound connections on the custom SSH port. For example, with ufw:
```
sudo ufw status
```
If the port is blocked, allow it:
```
sudo ufw allow <custom-port>/tcp
```
For iptables or other firewalls, adjust rules accordingly.
Verify Network Access
Ensure no network devices (routers, cloud security groups, VPS firewalls) block the custom port. For cloud servers, check security group rules to allow inbound traffic on the custom port.
Restart SSH Service If Needed
If any changes were made to sshd_config or firewall rules, restart the SSH service:
```
sudo systemctl restart sshd
```
or
```
sudo service ssh restart
```
Try Rsync Again
Run your rsync command including the SSH port specification once more. If all is set correctly, the connection should succeed.
Optional: Use SSH Config File for Convenience
To avoid typing the port each time, add an entry to your local ~/.ssh/config:
```
Host remote_alias
  HostName remote_host
  User user
  Port <custom-port>
```
Then connect with:
```
rsync -avz -e ssh /local/path remote_alias:/remote/path
```

Common Mistakes

Forgetting to specify the custom port in the rsync command, causing attempts to use default port 22.
Not checking if the SSH daemon is actually running or listening on the custom port.
Overlooking firewall rules blocking the custom port on the server or network level.
Assuming that the custom port is open externally without verifying cloud or hardware firewalls.
Modifying sshd_config incorrectly or without restarting SSH service afterward.
Typing errors in the port number or server hostname.

Tips

Use verbose mode in rsync and SSH (-v or -vv) to get detailed error messages for diagnosis.
Keep your SSH keys configured to avoid password prompts and speed up connection tests.
Test SSH connections independently from rsync to isolate the problem.
Consider temporarily reverting to port 22 to confirm if the issue is port-related.
Document any custom port settings to avoid confusion for yourself and others maintaining the system.

Use tools like telnet or nc (netcat) to test port accessibility:

telnet remote_host <custom-port>

nc -zv remote_host <custom-port>

Troubleshooting

If your rsync command still returns a “connection refused” error after following the steps above, try the following troubleshooting actions:

Verify SSH Service Status: On the remote machine, run sudo systemctl status sshd to ensure the SSH service is active. If it’s failed, check logs with journalctl -u sshd.
Check Listening Ports: Use ss -tuln or netstat -tulnp to confirm the SSH server listens on the custom port. If it’s not listed, the config file may have syntax errors or the service needs restarting.
Inspect Firewall Logs: Review firewall logs (e.g., /var/log/ufw.log or /var/log/messages) for denied connections on your custom port.
Test Port Reachability: From your local machine, use telnet or nc to verify the port is reachable. Connection refused here indicates network or firewall blockage.
Review SSH Configuration Syntax: A misconfiguration in sshd_config can cause SSH to fail silently. Use sshd -t to test the config file for errors.
Check SELinux or AppArmor: On systems with SELinux or AppArmor enabled, security policies might block SSH on non-standard ports. Temporarily disable or adjust policies to test.
Confirm No IP Restrictions: SSH can restrict allowed IP addresses in sshd_config or via hosts.allow/deny files. Verify these are not blocking your client.
Try a Different Client or Network: To rule out client-side issues or network restrictions, try connecting from another machine or network.
Enable Debug Logging on SSH Server: Increase SSH daemon log verbosity by setting LogLevel DEBUG in sshd_config and monitor logs while attempting connection.
Re-examine Rsync Command Syntax: Double-check your rsync command includes the -e "ssh -p <port>" flag exactly and that remote paths and usernames are correct.

Frequently Asked Questions

Why does rsync say “connection refused” when I use a custom SSH port?

This usually means rsync tried connecting to the default SSH port 22 instead of your custom port. You must explicitly tell rsync which port to use with the -e "ssh -p <port>" option.

Can I avoid specifying the SSH port every time in rsync?

Yes, by adding an entry to your local SSH config file (~/.ssh/config) with the custom port. Then you can use the host alias in your rsync commands without the -e option.

What if the SSH service isn’t running on the remote server?

You need to start or install the SSH server (usually sshd). Without it running, no SSH or rsync over SSH connections will succeed.

Could firewall rules cause “connection refused” errors?

Absolutely. Firewalls on the server, network, or cloud provider level might block your custom port. Ensure all relevant firewalls allow inbound TCP traffic on that port.

Is it possible that SELinux or AppArmor interfere with SSH on a custom port?

Yes. These security modules can restrict services from using certain ports. Check their logs and policies if you suspect they block your custom port.

How can I debug SSH connection issues beyond rsync errors?

Use verbose SSH commands like ssh -vvv -p <port> user@host to see detailed connection steps and errors, which helps pinpoint where the problem lies.

By carefully verifying SSH configuration, firewall rules, and specifying the correct port in your rsync command, you can resolve the “connection refused” error and maintain seamless file synchronization over SSH on custom ports.

How to Fix Rsync SSH Connection Refused on a Custom Port

How to Fix Rsync SSH Connection Refused on a Custom Port

What You’ll Need

Step-by-Step

Common Mistakes

Tips

Troubleshooting

Frequently Asked Questions

Why does rsync say “connection refused” when I use a custom SSH port?

Can I avoid specifying the SSH port every time in rsync?

What if the SSH service isn’t running on the remote server?

Could firewall rules cause “connection refused” errors?

Is it possible that SELinux or AppArmor interfere with SSH on a custom port?

How can I debug SSH connection issues beyond rsync errors?

Related