An SSH security default that pages as a network outage

The trap here is how convincingly the symptom mimics an unrelated class of problem. A security feature, on by default in current OpenSSH and therefore on most current Linux distributions, blocks a source address for a period of time after a small number of failed login attempts. The client sees “connection timed out”, which gives no hint at all that this is what happened. It reads exactly like a firewall rule, a routing problem, or a host that is simply not there.

Every instinct points outward, which is the expensive part. On 20260821 the first suspects were the cloud provider’s own firewall and then the path between the two machines, both entirely reasonable theories for a connection that used to work and now times out. Neither could be confirmed or ruled out quickly, which is a second tell. When a theory cannot be falsified with the tools at hand, it is worth pausing to ask whether a cheaper theory exists.

The cheaper theory in this case takes seconds to test. The SSH server can print its own effective configuration, including whether the penalty feature is enabled and what the thresholds are, and a retry from any other source address settles it immediately, because the block is per source. Two failed key attempts is a low bar to clear accidentally, particularly while building a new host and trying several keys in a row.

The value of writing this down is entirely in the symptom-to-cause mapping being available before the next person burns twenty minutes on the wrong theory, which is exactly what happened here on a day that had no other reason to suspect the target host itself.