diff --git a/lib/service/service.go b/lib/service/service.go
index <HASH>..<HASH> 100644
--- a/lib/service/service.go
+++ b/lib/service/service.go
@@ -432,6 +432,8 @@ func (process *TeleportProcess) initSSH() error {
 	eventsC := make(chan Event)
 	process.WaitForEvent(SSHIdentityEvent, eventsC, make(chan struct{}))
 
+	var s *srv.Server
+
 	process.RegisterFunc(func() error {
 		event := <-eventsC
 		log.Infof("[SSH] received %v", &event)
@@ -447,7 +449,7 @@ func (process *TeleportProcess) initSSH() error {
 			return trace.Wrap(err)
 		}
 
-		s, err := srv.New(cfg.SSH.Addr,
+		s, err = srv.New(cfg.SSH.Addr,
 			cfg.Hostname,
 			[]ssh.Signer{conn.Identity.KeySigner},
 			conn.Client,
@@ -470,8 +472,13 @@ func (process *TeleportProcess) initSSH() error {
 			return trace.Wrap(err)
 		}
 		s.Wait()
+		log.Infof("[SSH] node service exited")
 		return nil
 	})
+	// execute this when process is asked to exit:
+	process.onExit(func(payload interface{}) {
+		s.Close()
+	})
 	return nil
 }
"SSH node" service can now be stopped

when I did "stoppable Teleport" I wasn't running the "node" role, now I
added support for that.