issue solved! indeed, it was a bit silly: tcpwrappers was preventing sshd from connecting to localhost, as I discovered when poring through /var/log/secure . simply adding sshd: 127.0.0.1: ALLOW to /etc/hosts.allow and all is well.
thanks for being patient with my newbie confusion!