Using the VNC console to reach a VPS you cannot SSH into

Answer

Use the Virtualizor VNC console to get on to the VPS when SSH will not connect. It opens a browser-based console so you can log in locally, fix the SSH service, adjust the firewall or undo network changes. If the system will not boot cleanly, use Virtualizor Rescue Mode or boot from an ISO. Treat “Re-Install OS” as destructive.

Before you start

• You reach the VNC console in Virtualizor. Log in to your Hostworld client area at portal.hostworld.uk (WHMCS), open your VPS, then use the Virtualizor option to launch the HTML 5 VNC client.
• Keep the VNC console open while you test SSH changes. A bad SSH configuration or firewall rule can lock you out over the network. The console is your safety net.
• Have your VPS login to hand. If you do not know it or cannot reach Virtualizor, open a support ticket.
• Ubuntu 24.04 uses socket-activated OpenSSH and listens on IPv4 by default. Changing the SSH port on Ubuntu 24.04 and newer needs a “daemon-reload” and a restart of the socket to take effect.
• Debian images vary. Check whether ssh.socket is in use on yours before you assume a plain service restart is enough. The check is in Step 2.
• AlmaLinux 9 enforces SELinux by default. Moving SSH to a non-standard port needs an SELinux port mapping update or sshd will not bind the new port.
• Firewalls differ by OS. Ubuntu uses UFW. AlmaLinux uses firewalld. Enabling UFW before allowing SSH will block new SSH connections if defaults deny.
• Remote network edits can cut you off. On Ubuntu, use “netplan try” for a timed rollback. On AlmaLinux, bringing NetworkManager connections up can interrupt networking. Make changes from the console.
• Virtualizor provides Rescue Mode and ISO booting for recovery. These are for repair or data recovery. Be careful when mounting filesystems. Double-check device names before writing anything.
• Reinstalling the OS in Virtualizor wipes the VPS. Confirm backups first.

Step 1: Open the VNC console in Virtualizor

This gives you a keyboard and screen on your VPS even if the network is down.

• Log in to portal.hostworld.uk and go to your VPS. Launch the Virtualizor HTML 5 VNC client. In Virtualizor it is labelled “Launch HTML 5 VNC Client”.
• Log in on the console with your usual credentials. If you cannot launch VNC or cannot log in, open a support ticket.

The console gives you a root or sudo shell on the VPS itself, which is all the rest of this guide needs. For more on the Hostworld panels and what else Virtualizor can do for a VPS, see our VPS guides.

Step 2: Check the SSH service status

Start by seeing whether the SSH daemon is running and what it last logged. This confirms if you are dealing with a stopped service, a bad configuration or something else.

AlmaLinux 9

To see the sshd service status and follow its logs:

sudo systemctl status sshd.service
sudo journalctl -fu sshd.service

The first command shows whether sshd is active along with recent log lines. The second tails the logs so you can see fresh errors as they occur.

Ubuntu 24.04 and Debian

To see the state of the SSH unit, its socket and its logs:

sudo systemctl status ssh.service
sudo systemctl status ssh.socket
sudo journalctl -fu ssh.service

The first command shows whether the SSH service is healthy. The second tells you whether a socket is activating it on demand, which matters on Ubuntu 24.04 and may or may not be the case on your Debian image. The third tails the SSH server logs.

Step 3: Validate SSH configuration before restarting

Confirm that your SSH configuration parses. Restarting with a bad file closes the door on you. These two commands are the same on AlmaLinux, Ubuntu and Debian.

To syntax-check the configuration without restarting anything:

sudo sshd -t

This prints nothing on success. Any output describes the error, the file and the line.

To view the full effective configuration sshd will use:

sudo sshd -T | less

This lists the computed settings, including values pulled in from files in /etc/ssh/sshd_config.d/, so you can confirm options such as Port or PasswordAuthentication.

Step 4: Start or restart SSH safely

Only restart once the syntax check passes. Keep your VNC console open while you test a new SSH session from elsewhere.

AlmaLinux 9

sudo systemctl restart sshd.service
sudo systemctl enable sshd.service

The first command restarts sshd. The second makes sure it starts at boot.

Ubuntu 24.04 and Debian

Where SSH is socket-activated, restarting the socket is what makes port and ListenAddress changes take effect:

sudo systemctl daemon-reload
sudo systemctl restart ssh.socket
sudo systemctl restart ssh.service

The first command reloads systemd units if you changed any. The second restarts the socket so the new port is listened on. The third restarts the service. If Step 2 showed no ssh.socket on your Debian image, the service restart alone is what applies the change.

Step 5: Fix firewall rules for SSH

Blocking at the VPS firewall is a common cause. Allow SSH before enabling a deny-by-default firewall.

AlmaLinux 9 (firewalld)

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

The first command opens the ssh service in the default zone. The second applies the change. The third shows what is allowed now.

Ubuntu 24.04 and Debian (UFW)

sudo ufw allow OpenSSH
sudo ufw status verbose
sudo ufw enable

The first command creates an allow rule for SSH. The second shows the current rules. The third enables UFW if it was off. Allow SSH before you enable it, in that order. On Debian, UFW may not be installed or in use: if ufw status reports that the command is not found, check whichever firewall you configured instead.

Step 6: Confirm the port and address sshd is listening on

Match what the server is listening on to what you are connecting to. This catches typos and forgotten port changes. The command is the same on all three systems:

sudo ss -tlnp | grep ssh

This lists the listening sockets for the sshd process so you can check the port and the address. Ubuntu 24.04 defaults to IPv4 listening.

Step 7: Apply port changes correctly

If you changed the SSH port, make sure the service and the OS agree. Otherwise sshd fails to bind, or it keeps listening on the old port.

AlmaLinux 9

To permit a new SSH port under SELinux so sshd can bind it:

sudo semanage port -a -t ssh_port_t -p tcp 2222 || sudo semanage port -m -t ssh_port_t -p tcp 2222
sudo systemctl restart sshd.service

The first command adds the SELinux mapping for port 2222, or modifies it if a mapping already exists. The second restarts sshd. Verify with the command in Step 6.

Ubuntu 24.04 and Debian

Run sudo sshd -t from Step 3, then the restart sequence from Step 4, then the check from Step 6. The socket restart is the part people miss, and without it sshd carries on listening where it always did.

Step 8: Resolve configuration overrides

On Ubuntu and Debian, snippets in /etc/ssh/sshd_config.d can override your main sshd_config. Cloud images often ship a 50-cloud-init.conf file with its own defaults.

AlmaLinux 9

Open /etc/ssh/sshd_config in whichever editor is installed on your image and read it for directives you did not put there. Then validate and restart:

sudo sshd -t
sudo systemctl restart sshd.service

The first command validates the syntax. The second restarts sshd if the file is valid.

Ubuntu 24.04 and Debian

To check and adjust overrides provided by cloud-init or other packages:

sudo editor /etc/ssh/sshd_config.d/50-cloud-init.conf
sudo editor /etc/ssh/sshd_config
sudo sshd -t

The first two commands open the snippet and the main file so you can align them. The third validates the syntax. Apply the change with the restart sequence from Step 4.

Step 9: Unban your IP if Fail2ban blocked you

Too many failed logins can trigger a ban. Unban your current public IP while you investigate. The commands are the same on AlmaLinux, Ubuntu and Debian:

sudo fail2ban-client status
sudo fail2ban-client set sshd unbanip YOUR.PUBLIC.IP

The first command lists the active jails. The second removes your address from the sshd jail ban list. Replace YOUR.PUBLIC.IP with the address you are connecting from.

Step 10: Recover from broken networking safely

If SSH problems trace back to network changes, use tools that give you a rollback, and make the change from the VNC console rather than over SSH.

AlmaLinux 9

sudo nmcli connection up <connection-name>

This brings a NetworkManager connection up and can momentarily disrupt networking. Make changes like this from the console and plan a maintenance window if the VPS is in use.

Ubuntu 24.04 and Debian

Where Netplan is in use, test the new configuration with an automatic rollback:

sudo netplan try

This applies the configuration and prompts you to confirm. If you cannot confirm, it rolls back after a timeout. When you are sure the change is correct:

sudo netplan apply

This makes the change take effect immediately, with no rollback. Debian images do not all use Netplan, so check how networking is configured on yours before you edit anything.

Step 11: Use Virtualizor Rescue Mode if the OS will not boot

Rescue Mode boots your VPS into a Debian-based environment so you can mount the original disk and repair files or recover data. LVM volumes are supported.

• In Virtualizor, enable Rescue Mode for your VPS and boot into it. Then launch the HTML 5 VNC client to access the rescue shell.
• Mount your original VPS disk read-only first while you inspect it. Only write changes once you are sure you have the right device.
• When finished, disable Rescue Mode in Virtualizor and boot back to your normal disk.

If you are unsure which device to mount or what to fix, open a support ticket.

Step 12: Boot from an ISO for repair tools

You can mount an ISO in Virtualizor and set the boot order to CD first. Hostworld allows customers to upload a custom ISO, so you can use the rescue tools you prefer. Which images appear in the list is controlled in Virtualizor.

• Mount the ISO in Virtualizor and set the boot order to CD first. Stop the VPS, then start it to boot from the ISO.
• Work from the VNC console. Take care not to write to the wrong disk.
• When finished, unmount the ISO and return the boot order to disk first.

Step 13: Reinstall the OS only if you mean to wipe the server

Virtualizor “Re-Install OS” recreates the VPS with a fresh OS and does not retain previous data. Use this only if you have backups you can restore and you intend to start again.

• Confirm your backups. Reinstalling is destructive.
• Use Virtualizor to pick a new AlmaLinux, Ubuntu or Debian image, or your Windows Server licence if you have a Windows VPS. You can also upload a custom ISO if you need a particular image.
• If you want advice before you proceed, open a support ticket.

What next

If you are new to the Hostworld panels and tools, browse our VPS guides for more maintenance and recovery topics. If you are planning a fresh start after recovery, look at our London VPS range, which runs in a UK data centre in London, and our US plans in New York.

If you get stuck at any point above, or the VNC console does not launch for your account, please open a support ticket. Tickets are the fastest way for us to work on the same VPS record as you.