All Products
Search

This Product

    :Incorrect SSH permissions block remote connection to a Linux instance

    Document Center

    :Incorrect SSH permissions block remote connection to a Linux instance

    Last Updated:Apr 15, 2026

    Issue

    You cannot log on to a Linux instance due to incorrect SSH permissions.

    Cause

    This issue occurs when SSH-related files and directories on the Linux instance have incorrect or insufficient permissions.

    Solution

    Note

    • Before performing high-risk operations, such as modifying an instance or its data, have a disaster recovery and fault tolerance plan to ensure data security.

    • Before modifying the configuration or data of an instance, such as an ECS or RDS instance, create a snapshot or enable backups, such as RDS log backup.

    • If you have submitted sensitive information, such as usernames and passwords, on the Alibaba Cloud platform, change them immediately.

    1. Detach the system disk from the affected ECS instance and attach it as a data disk to a healthy ECS instance. For details, see Best practices for data recovery on Linux instances.

    2. Log on to the healthy ECS instance, switch to the root user, and run the following command to reset the permissions of the /var/empty/sshd directory. 

      chmod 711 /var/empty/sshd
      Note

      Do not set the permissions to 777.

    3. Follow the steps in Best practices for data recovery on Linux instances to reattach the system disk to the original instance.

    4. Remotely connect to the ECS instance to verify the fix.

    More information

    In addition to checking the permissions of the /var/empty/sshd directory, you can also use this method to check the permissions for the /etc/passwd, /etc/group, /etc/shadow, and /etc/gshadow files, and the /etc/securetty directory. To find the correct permissions, you can compare the settings on the affected instance with those on a healthy one.

    Applies to

    • ECS