Antminer – SSH Connection Refused

Power-cycle the miner. 30 seconds off at the breaker — not a soft restart from the web UI. Clears any wedged daemon state on custom firmware where `dropbear` might have crashed. Wait 3 minutes for full boot before retrying SSH. If you were running DCENT_OS / Braiins OS+ / LuxOS / Vnish and SSH was working before, this resolves ~40% of `ERR_SSH` reports on custom firmware immediately. Document which firmware you're running *before* you reboot — the web-UI login screen shows it on the title bar.

Confirm you're not fighting a network or firewall issue. Browse to `http://<miner-ip>` — if the web UI loads, the miner is on the network and the control board is up, so the problem is specifically SSH, not a dead miner. Run `ping <miner-ip>` from your LAN; healthy ping + open port `80` + refused port `22` = SSH daemon issue only. If ping fails too, see the [network sibling error](#related-errors) — this page won't help.

Identify the exact firmware build. Web UI → `System` → `Firmware Upgrade` (S9/S17) or `Administration` → `Firmware Upgrade` (S19/S21). Record the full build string. Bitmain stock post-`2019-11-05` on S9 and every stock build on S17 / S19 / S21 ships SSH off — this is expected behaviour, not a bug. If the build is stock Bitmain, SSH isn't "broken," it was never on.

Verify credentials if the daemon is up. `nmap -p 22 <miner-ip>` — if port `22` reports `open`, the daemon is running and you have a credentials problem, not a `Connection refused` problem. Try `root/admin` first (Braiins OS+ / LuxOS default), then `root/root`, then `admin/admin` (Vnish). One attempt per credential set — repeated failures can trigger fail2ban-style lockouts on Braiins OS+ `24.x`. DCENT_OS is different: `root/admin` is not a DCENT_OS credential. On its release images (the published S9 and S19j Pro builds carry the `/etc/dcentos/release-image` marker) `dropbear` does not start at all until the first-boot wizard password is set or an `authorized_keys` file exists at `/data/dcent/authorized_keys` (`/etc/init.d/S50dropbear`, `/usr/sbin/dcent-enable-ssh`), so a closed port 22 on a fresh unit is the lockdown working, not a fault. Once SSH is open, the root account uses the build-time password recorded in the repo's install guide (`docs/DCENT_OS_INSTALL_GUIDE.md`) — it is not `admin`.

Check your SSH client version. Some OpenSSH 9.x clients default to rejecting `ssh-rsa` host keys, which older `dropbear` builds on S9 / S17 still serve. Add `-o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa` to your `ssh` command once, and if it connects, the problem was client-side algorithm policy, not the miner. Catches ~5% of "I updated macOS and now SSH doesn't work" tickets.

Back up what you can from the web UI first. Settings → `Backup Config`, save the `.conf` file somewhere safe. Custom firmware flashes will wipe pool config, worker names, autotuning profiles, network statics. Having the config blob means a 10-minute restore post-flash instead of a 30-minute reconfigure from memory. Screenshot your OC profile too if you've tuned this miner.

S9 pre-`2019-11-05` stock: edit `dropbear` init script via SD-card. This only works on late-generation S9-family stock images that predate the lockdown — approximately `Antminer-S9-all-201908*` and earlier. Pull the SD card, mount the `rootfs` partition on a Linux host, edit `/etc/init.d/dropbear` to remove the `-i` flag or the bind-to-localhost line, save, reinsert SD, boot. This is a narrow, specific hack — if your firmware is newer, skip to Step 8. Detailed walkthrough in the [S9-era bitmaintech/cgminer issue archive](https://github.com/bitmaintech/cgminer).

Flash a third-party firmware that ships SSH enabled. On Antminer the candidates are Braiins OS+, LuxOS and Vnish — all three give you the shell that stock Bitmain images from 2019 onward deliberately closed, plus per-chip HW%, tuning and autotuning. Confirm your exact model and hardware revision against the vendor's published matrix, then follow their own upgrade procedure; do not improvise one. Of the three, only Braiins OS+ ships a native Stratum V2 client. DCENT_OS, D-Central's own GPL-3.0 Antminer firmware, is not a route here: it publishes a downloadable image for the S9 (Zynq/XIL) and the S19j Pro (Zynq/XIL) only, no model has a published witnessed first-install route, and there is no web-UI upgrade path we can stand behind. Source and current status: `https://github.com/DCentralTech/DCENT_OS` and https://d-central.tech/dcent-os/.

Flash Braiins OS+ as an alternative. Same flash path via web UI, `braiins-os_*.tar.gz` from `https://braiins.com/os/plus`. Braiins is commercial-grade, well-documented, mature, and has the best per-chip telemetry in the industry. SSH on by default, `root/admin`. Confirm your exact model and hardware revision against Braiins' published support matrix before you upgrade, and follow their own procedure rather than improvising one.

Flash LuxOS or Vnish if you're targeting a specific feature. LuxOS (`https://luxor.tech/luxos`) has strong pool-operator tooling and Luxor-integrated telemetry. Vnish has the best stock-looking UI and the longest-standing community for Antminer customisation. Both enable SSH by default. Choose on features, not on principle — Braiins OS+, LuxOS and Vnish all restore SSH, and each publishes its own model list, so check yours before you write anything.

Generate and install an SSH key immediately post-flash. Don't stay on password auth for a production miner. From your workstation: `ssh-keygen -t ed25519 -C "miner-farm-$(date +%Y)"`, then `ssh-copy-id root@<miner-ip>`, then on the miner `passwd -l root` to lock password auth entirely. Edit `/etc/dropbear/dropbear.conf` or equivalent to set `PasswordAuthentication no`. Reboot. Now the miner only accepts your key — dramatically safer than a shared `root/admin` across a fleet.

Set a strong root password if you're keeping password auth. On Braiins OS+: `ssh root@<miner-ip>`, `passwd`, enter a 20+ character random string, record in your password manager. On DCENT_OS `passwd` does not stick: the root filesystem is a read-only squashfs, `/etc/shadow` is not on the persistent `/data` overlay, and `/etc/default/dropbear` ships with password auth on (`DROPBEAR_ARGS=""`). What you can do today: keep SSH closed unless you need it (`/data/dcent/.ssh-disabled` is the S50dropbear opt-out and survives reboots), treat the build-time root password as public (the repo's install guide prints it), and keep the unit off any LAN you do not control — there is no supported key-only mode on the image yet (`/root/.ssh` ships empty on a read-only rootfs). Bitmain's default-password lockdown was a response to real botnet activity — do not run a LAN-reachable miner with `root/admin` on password auth if you can help it.

UART console as the out-of-band path. USB-to-TTL adapter (FTDI FT232RL, 3.3 V logic — *not* 5 V, which will damage the control board). Connect `TX → RX` / `RX → TX` / `GND → GND` on the control-board UART header (S9: 3-pin header near the SD card, S17/S19: `J4` or `J7` per hardware revision). `picocom -b 115200 /dev/ttyUSB0` on Linux, `putty` with COM port + 115200 baud on Windows. Power on, you get bootloader prints, then a login prompt on most builds. On stock Bitmain where SSH is off, the UART *is* your shell — no network daemon required.

Boot into initramfs / recovery. On S17 and S19, holding the `RESET` button during power-on for ~15 seconds drops the miner into a minimal recovery initramfs that accepts a `.bin` upload over HTTP on a hardcoded IP (`192.168.1.1` on many builds). Useful when you've bricked the main rootfs trying to enable SSH and need to flash clean. Detailed in each custom firmware's README; wrong-hardware-revision firmware will brick the control board from here, so verify the board rev before you push a `.bin`.

Do not try to replace `dropbear` with OpenSSH on DCENT_OS. DCENT_OS is a Buildroot image with no package manager and no package feed: there is no `opkg`, no `/etc/config/dropbear` and no `sshd_config` on it. SSH is `dropbear` only (`BR2_PACKAGE_DROPBEAR=y` in the build; `/etc/init.d/S50dropbear` on the image), and on a release image it stays off until you finish the first-boot wizard with SSH enabled or upload an `authorized_keys` file through the dashboard — the helper that flips the gate is `/usr/sbin/dcent-enable-ssh`, and host keys persist under `/data/keys/dropbear`. If you need OpenSSH-only client features (`ProxyJump`, `ProxyCommand`), configure them in your workstation's `~/.ssh/config` — they are client-side and work against a `dropbear` server. Source: `github.com/DCentralTech/DCENT_OS` — `br2_external_dcentos/configs/dcentos-common.fragment` and `board/zynq/rootfs-overlay/etc/init.d/S50dropbear`.

Audit `/var/log/messages` or `/var/log/syslog` for `dropbear` startup errors. Once you're in (via SSH, UART, or web UI console on Braiins OS+), `tail -f /var/log/messages | grep dropbear` catches crash reasons: OOM during autotune, broken `authorized_keys` format, port `22` already bound by a stale process. Fixes tend to be one-liners — `killall dropbear; /etc/init.d/dropbear restart`, or a malformed `authorized_keys` file with a stray newline.

When to stop DIY. You've flashed DCENT_OS / Braiins OS+ / LuxOS / Vnish and SSH still doesn't work *and* the web UI doesn't work either — that's a control-board problem, not an SSH problem. Or UART is dead too (no bootloader output, no kernel prints, no login prompt) — that's an eMMC / SoC / power-regulation failure on the control board. At that point you're in test-fixture territory and flashing more firmware will not help. Book a D-Central ASIC Repair slot at `https://d-central.tech/asic-repair/`. Ship the control board alone if the hashboards are working — it's cheaper and faster.

Ship safely if you're going the Repair Service route. Anti-static bag on the control board, double-boxed with at least 5 cm of foam on every side. Include a note with: exact miner model + hardware revision (visible on the control-board silkscreen or the chassis sticker), firmware history (stock → Braiins → DCENT_OS, dates if known), symptom summary (`ERR_SSH` + dead UART + web UI fails on both stock and custom firmware), and your contact details. Good paperwork cuts diagnostic time and directly reduces your final invoice. Typical turnaround 5–10 business days, Canadian shipping, US and international welcomed.