Bytmsg | Linux system troubleshooting

When you're trying to transfer files using SCP (Secure Copy Protocol) to your EC2 instance and encounter the error message: "Connection closed by port 22", it can be frustrating, especially if the configuration appears to be correct. This issue is common but can be resolved through various troubleshooting steps.

In this article, we will explore the potential causes of the error, possible solutions, and preventive measures to ensure smooth SCP file transfers to your EC2 instance.

---

Understanding the Issue

SCP is a tool used for securely transferring files between machines over a network. When you attempt to use SCP to transfer a file to an EC2 instance, it uses SSH (Port 22 by default) for communication. If there's an issue with SSH or the security settings of the EC2 instance, you may encounter the error "Connection closed by port 22".

This error indicates that the SCP client was unable to establish a connection or that the connection was closed unexpectedly during the transfer process. It can occur for several reasons, including misconfigurations in the EC2 instance, network issues, or SSH daemon problems.

---

Common Causes and Solutions

1. SSH Configuration Issues on EC2 Instance

One of the most common reasons for the "Connection closed by port 22" error is improper SSH configuration on your EC2 instance. The SSH daemon might be configured incorrectly or could have been stopped.

Solution:

• Check SSH Service: Ensure that the SSH service is running on your EC2 instance.

  Log in to your EC2 instance through the EC2 console or via another working SSH session and run the following command:

  sudo systemctl status sshd
  

  If SSH is not running, start it:

  sudo systemctl start sshd
  

• Verify SSH Configuration: Check the SSH configuration file (/etc/ssh/sshd_config) for any misconfigurations, especially those that might limit connections.

  Ensure the following lines are configured correctly:

  Port 22
  PermitRootLogin no
  PasswordAuthentication yes (if you are using password-based authentication)
  

  After editing, restart the SSH service:

  sudo systemctl restart sshd
  

2. Security Group or Firewall Issues

If your EC2 instance's security group is misconfigured, it could block inbound connections to port 22, causing SCP to fail.

Solution:

• Check Security Group Rules: In your EC2 Management Console, go to Security Groups under Network & Security and verify that the inbound rules allow traffic on port 22.

  Ensure that the security group associated with your EC2 instance allows SSH traffic from your IP address or the range of IP addresses you are connecting from. For example, you can allow SSH access from a specific IP:

  Type: SSH
  Protocol: TCP
  Port Range: 22
  Source: <Your IP address>/32
  

  Alternatively, you can open it to all IPs for testing (not recommended for production):

  Source: 0.0.0.0/0
  

  After modifying the security group, try the SCP command again.

3. Incorrect Private Key Permissions

If you're using key-based authentication (which is common with EC2 instances), incorrect permissions on your private key can prevent SCP from establishing a connection.

Solution:

• Check Private Key Permissions: Ensure that your private key has the correct permissions. The key file should have restrictive permissions:

  chmod 600 /path/to/your/private-key.pem
  

• Verify Key Used in SCP Command: Make sure you're using the correct private key file for authentication by specifying it with the -i option:

  scp -i /path/to/your/private-key.pem file.txt ec2-user@ec2-instance-public-dns:/path/to/destination/
  

4. Instance Might Be Stopped or Inaccessible

If the EC2 instance has been stopped or is in a stopped state, you won't be able to connect via SCP, as the instance isn't running.

Solution:

• Check EC2 Instance Status: In the EC2 Dashboard, verify that your instance is in a running state. If it’s stopped, start it:

  aws ec2 start-instances --instance-ids <instance-id>
  

• Check Instance Health: Ensure that the instance is healthy and has passed all health checks. An unhealthy instance can lead to SSH connectivity issues.

5. IP Address or DNS Resolution Issues

If your EC2 instance has a dynamic IP (which it does by default), the public IP or DNS name may have changed after a restart or instance stop/start.

Solution:

• Check the Correct Public IP: Use the AWS EC2 console to find the current public IP address or DNS name for your EC2 instance and update your SCP command to reflect the correct IP address.

  For example, make sure you're using the updated public DNS name:

  scp -i /path/to/your/private-key.pem file.txt ec2-user@ec2-public-dns:/path/to/destination/
  

6. Network or Routing Problems

Network connectivity issues such as intermittent connectivity, routing misconfigurations, or issues with your local network could lead to the connection being closed unexpectedly.

Solution:

• Check Network Configuration: Run a simple SSH command to test the network connection:

  ssh -i /path/to/your/private-key.pem ec2-user@ec2-public-dns
  

  If you are unable to establish an SSH connection, this may indicate a network or routing issue. You can also run a traceroute to see where the connection is being blocked:

  traceroute ec2-public-dns
  

• Test from Another Network: Sometimes, local network firewalls or restrictions can interfere with the connection. Try connecting from a different network to see if the issue persists.

7. SSH KeepAlive Settings

Sometimes, SCP or SSH connections might be closed by the server if there are long periods of inactivity, particularly in networks with strict timeout settings.

Solution:

• Increase KeepAlive Settings: You can modify the SSH configuration on the EC2 instance to keep the connection alive. Edit the /etc/ssh/sshd_config file on the server and add or modify the following lines:

  ClientAliveInterval 60
  ClientAliveCountMax 120
  

  After saving the changes, restart the SSH service:

  sudo systemctl restart sshd
  

8. Corrupt or Misconfigured SCP Client

If your SCP client is corrupted or misconfigured, it could fail to connect to the EC2 instance.

Solution:

• Reinstall SCP/SSH Client: If you're using a specific SCP client (like OpenSSH or WinSCP), consider reinstalling it or updating it to the latest version.

  For example, to reinstall OpenSSH on a Linux machine:

  sudo apt-get install --reinstall openssh-client
  

  Alternatively, for Windows users, using WinSCP or PuTTY might also require updating the software.

---

Preventive Measures for Future SCP Connections

1. Use Elastic IPs: To prevent IP address changes upon instance restart, consider associating an Elastic IP (EIP) with your EC2 instance. This provides a static public IP address that remains consistent across instance stop/start cycles.

2. Automate Security Group Configuration: Automate your security group configuration by using AWS CloudFormation or Terraform. This way, the correct security group settings are always applied.

3. Use EC2 Instance Connect: For improved reliability, consider using EC2 Instance Connect, which allows you to securely connect to your instance without requiring SSH keys.

4. Enable Multi-Factor Authentication (MFA): To enhance security, ensure your EC2 instance requires multi-factor authentication (MFA) for access.

---

Conclusion

The "Connection closed by port 22" error when using SCP to transfer files to an EC2 instance is a common issue that can arise from various sources, such as SSH configuration problems, security group misconfigurations, or network issues. By following the solutions outlined in this article—checking the SSH configuration, verifying security group settings, ensuring correct private key permissions, and addressing network connectivity issues—you should be able to resolve this error and successfully transfer files to your EC2 instance.

By adopting preventive measures like using Elastic IPs and automating security group configurations, you can avoid facing this issue in the future and ensure reliable and secure file transfers.