I have Linux running on a virtual machine, trying to log in from the host OS:

$ ssh -l root 172.16.33.1
root@172.16.33.1's password:
Permission denied, please try again.
root@172.16.33.1's password:
Permission denied, please try again.
root@172.16.33.1's password:
Permission denied (publickey,password).

Inside the VM:

# cat /etc/ssh/sshd_config
PermitRootLogin yes
PasswordAuthentication yes
UseLogin yes

What else is missing?

You don't provide details, such as version/distro of Linux, any firewalls in place between the two, whether the service is actually even started or not, or whether you restarted it to make the changes take effect. Can you even log in as a 'regular' user? Because logging in as root is an INCREDIBLY BAD IDEA, and there's just no need to do it. Log in as a regular user, and use su or sudo as needed.

I have a firewall that should never block local traffic, but turned it off anyway and it didn't make any difference.

Security is no concern. It's a virtual machine. It's just for tests. I want to log in as root.

And did you turn off firewalls on BOTH sides? Did you open the port for SSH, because it's blocked by default. And you still haven't answered things asked before, such as version/distro of Linux, did you restart/start the service, etc., nor whether you can log in as a regular user. And now you say it's a VM...can you even ping between the host and guest? Until you answer and provide details, there isn't much anyone can tell you.
Learn to do things correctly, if you're starting out. No one, anywhere, that does IT professionally, will log in as root. But you've been here FOURTEEN YEARS....should be obvious not to do this, and why.

I said it in the original post.

It's Debian 9. There is no firewall in the guest OS. There is nothing in it. It's just the most basic net install.

Yes, I can ping the guest OS. I can log in through SSH as root inside the VM/guest. I can't log in from the host OS. It can't be firewall related because the error message makes it very clear that the connection is established. It's just that sshd rejects my login attempt. Why? I have checked all sshd_config options. Or have I?

Well, regular user can't log in either. It can from inside the VM itself, but not from outside.

There you go.
Did you post your entire sshd_config? Because what you posted doesn't appear to be complete.
Did you confirm that sshd is actually running and listening on the default port?

1 members found this post helpful.

Are you saying you have 3 machines? 2 physical machines, and 1 of them has a Debian VM? So from the physical machine that doesn't have the VM, you are able to SSH to the VM on the other physical machine? Am I getting that right?

Which VM software are you using? virtualbox? What OS does your host have?

$ ssh -l nix 172.16.33.1
nix@172.16.33.1's password:
Permission denied, please try again.
nix@172.16.33.1's password:
Permission denied, please try again.
nix@172.16.33.1's password:
Permission denied (publickey,password).

# service ssh status


/var/log/syslog


/var/log/auth

One physical Debian 9 connecting to a virtual Debian 9 inside aforementioned Debian 9 on VMWare.

I don't understand exactly how I fixed it, but I did.

I ran ifconfig in the VM:



I noticed an IP number in it that I hadn't tried: 172.16.33.146

So I connects to it:

$ ssh -l root 172.16.33.146

It wants to add the new server to ~/.ssh/known_hosts, I accept it, and it works.

Solved. Thank you all.

Glad you got it worked out. Some thoughts to consider:
You apparently have the networking configured to use DHCP.
You didn't know what the IP address was until you ran ifconfig on the VM.
Once you knew the IP address, then you were able to connect.
Note that you will get the prompt to add the key to known_hosts again if the IP address changes. You will also get that prompt again if you sign in as a different user.
Q: Why did you think the address was 172.16.33.1?
Q: What is actually running on 172.16.33.1? (Since you could connect to that IP, but not login -- the router, perhaps?)
[Those questions are food for thought for you, but it might be helpful to others if you want to share the answers]

I got that from running ifconfig on the host OS, which gave me that one and another IP number for vmnet1 and vmnet8, respectively. Both failed. It didn't occur to me to run ifconfig on the guest OS until much much later. They pinged and sshd did respond to them, which was confusing as hell. I still don't understand why sshd will respond but forbid access. If at least sshd was unreachable, it would make sense.

Perhaps the passwords are different on the host? The responses you posted indicate an incorrect user or password.