Antminer – SSH Connection Refused

Power-cycle the miner. 30 seconds off at the breaker — not a soft restart from the web UI. Clears any wedged daemon state on custom firmware where `dropbear` might have crashed. Wait 3 minutes for full boot before retrying SSH. If you were running DCENT_OS / Braiins OS+ / LuxOS / Vnish and SSH was working before, this resolves ~40% of `ERR_SSH` reports on custom firmware immediately. Document which firmware you're running *before* you reboot — the web-UI login screen shows it on the title bar.

Confirm you're not fighting a network or firewall issue. Browse to `http://<miner-ip>` — if the web UI loads, the miner is on the network and the control board is up, so the problem is specifically SSH, not a dead miner. Run `ping <miner-ip>` from your LAN; healthy ping + open port `80` + refused port `22` = SSH daemon issue only. If ping fails too, see the [network sibling error](#related-errors) — this page won't help.

Identify the exact firmware build. Web UI → `System` → `Firmware Upgrade` (S9/S17) or `Administration` → `Firmware Upgrade` (S19/S21). Record the full build string. Bitmain stock post-`2019-11-05` on S9 and every stock build on S17 / S19 / S21 ships SSH off — this is expected behaviour, not a bug. If the build is stock Bitmain, SSH isn't "broken," it was never on.

Verify credentials if the daemon is up. `nmap -p 22 <miner-ip>` — if port `22` reports `open`, the daemon is running and you have a credentials problem, not a `Connection refused` problem. Try `root/admin` first (DCENT_OS / Braiins OS+ / LuxOS default), then `root/root`, then `admin/admin` (Vnish). One attempt per credential set — repeated failures can trigger fail2ban-style lockouts on Braiins OS+ `24.x`.

Check your SSH client version. Some OpenSSH 9.x clients default to rejecting `ssh-rsa` host keys, which older `dropbear` builds on S9 / S17 still serve. Add `-o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa` to your `ssh` command once, and if it connects, the problem was client-side algorithm policy, not the miner. Catches ~5% of "I updated macOS and now SSH doesn't work" tickets.

Back up what you can from the web UI first. Settings → `Backup Config`, save the `.conf` file somewhere safe. Custom firmware flashes will wipe pool config, worker names, autotuning profiles, network statics. Having the config blob means a 10-minute restore post-flash instead of a 30-minute reconfigure from memory. Screenshot your OC profile too if you've tuned this miner.

S9 pre-`2019-11-05` stock: edit `dropbear` init script via SD-card. This only works on late-generation S9-family stock images that predate the lockdown — approximately `Antminer-S9-all-201908*` and earlier. Pull the SD card, mount the `rootfs` partition on a Linux host, edit `/etc/init.d/dropbear` to remove the `-i` flag or the bind-to-localhost line, save, reinsert SD, boot. This is a narrow, specific hack — if your firmware is newer, skip to Step 8 and flash DCENT_OS or Braiins OS+ instead. Detailed walkthrough in the [S9-era bitmaintech/cgminer issue archive](https://github.com/bitmaintech/cgminer).

Flash DCENT_OS (Bitmain S9 / S17 / S19 / S21 family — recommended). DCENT_OS is D-Central's own open-source Antminer firmware — all the per-chip HW%, tuning, autotuning, stratum v2 features of the commercial alternatives, maintained in the open by Mining Hackers. SSH on by default, `root/admin` credentials, no licensing fees, no vendor lock-in. Download from `https://d-central.tech/dcent-os/`, upload via web UI → `Firmware Upgrade` → `Choose File` → `Upgrade`. Takes 6–10 minutes; the miner reboots, comes back on the same IP, you log in at `root/admin` and SSH works immediately. Source on GitHub: `https://github.com/DCentralTech/DCENT_OS`.

Flash Braiins OS+ as an alternative. Same flash path via web UI, `braiins-os_*.tar.gz` from `https://braiins.com/os/plus`. Braiins is commercial-grade, well-documented, mature, and has the best per-chip telemetry in the industry. SSH on by default, `root/admin`. Pick it over DCENT_OS if you specifically want Braiins' autotuning algorithm or their paid pool support — otherwise DCENT_OS covers the same diagnostic ground without the vendor relationship.

Flash LuxOS or Vnish if you're targeting a specific feature. LuxOS (`https://luxor.tech/luxos`) has strong pool-operator tooling and Luxor-integrated telemetry. Vnish has the best stock-looking UI and the longest-standing community for Antminer customisation. Both enable SSH by default. Choose on features, not on principle — any of DCENT_OS / Braiins OS+ / LuxOS / Vnish restores SSH.

Generate and install an SSH key immediately post-flash. Don't stay on password auth for a production miner. From your workstation: `ssh-keygen -t ed25519 -C "miner-farm-$(date +%Y)"`, then `ssh-copy-id root@<miner-ip>`, then on the miner `passwd -l root` to lock password auth entirely. Edit `/etc/dropbear/dropbear.conf` or equivalent to set `PasswordAuthentication no`. Reboot. Now the miner only accepts your key — dramatically safer than a shared `root/admin` across a fleet.

Set a strong root password if you're keeping password auth. On DCENT_OS / Braiins OS+: `ssh root@<miner-ip>`, `passwd`, enter a 20+ character random string, record in your password manager. Bitmain's default-password lockdown was a response to real botnet activity — do not run a LAN-reachable miner with `root/admin` on password auth if you can help it.

UART console as the out-of-band path. USB-to-TTL adapter (FTDI FT232RL, 3.3 V logic — *not* 5 V, which will damage the control board). Connect `TX → RX` / `RX → TX` / `GND → GND` on the control-board UART header (S9: 3-pin header near the SD card, S17/S19: `J4` or `J7` per hardware revision). `picocom -b 115200 /dev/ttyUSB0` on Linux, `putty` with COM port + 115200 baud on Windows. Power on, you get bootloader prints, then a login prompt on most builds. On stock Bitmain where SSH is off, the UART *is* your shell — no network daemon required.

Boot into initramfs / recovery. On S17 and S19, holding the `RESET` button during power-on for ~15 seconds drops the miner into a minimal recovery initramfs that accepts a `.bin` upload over HTTP on a hardcoded IP (`192.168.1.1` on many builds). Useful when you've bricked the main rootfs trying to enable SSH and need to flash clean. Detailed in each custom firmware's README; wrong-hardware-revision firmware will brick the control board from here, so verify the board rev before you push a `.bin`.

Replace `dropbear` with full OpenSSH on DCENT_OS. Advanced use case — only if you specifically need OpenSSH features (`ProxyCommand`, certificate auth, aggressive multiplexing) that `dropbear` doesn't support. DCENT_OS ships a package feed; `opkg update && opkg install openssh-server`, edit `/etc/config/dropbear` to disable the default daemon, edit `/etc/ssh/sshd_config` to enable `sshd`, reboot. Production-only if you know what you're doing — a broken `sshd_config` here locks you out via SSH *and* leaves you relying on UART.

Audit `/var/log/messages` or `/var/log/syslog` for `dropbear` startup errors. Once you're in (via SSH, UART, or web UI console on Braiins OS+), `tail -f /var/log/messages | grep dropbear` catches crash reasons: OOM during autotune, broken `authorized_keys` format, port `22` already bound by a stale process. Fixes tend to be one-liners — `killall dropbear; /etc/init.d/dropbear restart`, or a malformed `authorized_keys` file with a stray newline.

When to stop DIY. You've flashed DCENT_OS / Braiins OS+ / LuxOS / Vnish and SSH still doesn't work *and* the web UI doesn't work either — that's a control-board problem, not an SSH problem. Or UART is dead too (no bootloader output, no kernel prints, no login prompt) — that's an eMMC / SoC / power-regulation failure on the control board. At that point you're in test-fixture territory and flashing more firmware will not help. Book a D-Central ASIC Repair slot at `https://d-central.tech/services/asic-repair/`. Ship the control board alone if the hashboards are working — it's cheaper and faster.

Ship safely if you're going the Repair Service route. Anti-static bag on the control board, double-boxed with at least 5 cm of foam on every side. Include a note with: exact miner model + hardware revision (visible on the control-board silkscreen or the chassis sticker), firmware history (stock → Braiins → DCENT_OS, dates if known), symptom summary (`ERR_SSH` + dead UART + web UI fails on both stock and custom firmware), and your contact details. Good paperwork cuts diagnostic time and directly reduces your final invoice. Typical turnaround 5–10 business days, Canadian shipping, US and international welcomed.