When I tried to log into my remote Ubuntu server today, I got:
ssh: connect to host <ip> port 22: Connection refused
So I rebooted the server, thinking sshd might have crashed.
After the boot I could connect via ssh, but after 1 or 2 minutes the server closed the connection:
Connection to <ip> closed by remote host.
Trying to reconnect, the server refuses the connection again.
Manually doing
/etc/init.d/sshd restart
didn't help, /etc/hosts.deny seems ok.
This is extremely annoying, since I have so little time to diagnose or fix the problem. Help or ideas are greatly appreciated!
grep -ir ssh /var/log/*
and found nothing interesting or related, but some people seem to be spamming my ssh like crazy (ddos style) trying to log in as root (the events are usually some weeks apart) WTF!