Centos 6 cannot ssh externally?

newbie14 · 01-03-2012, 12:14 PM

Dear Repo,
Below is the latest result. I have port forward 2222 on router but still I cannot log in but using local ip I can still go in after changing to port 2222.

Starting Nmap 4.75 ( http://nmap.org ) at 2012-01-03 19:10 Central Europe Standard Time
Interesting ports on 82.124.in-addr.arpa.tm.net.my (124.82.40.118):
PORT STATE SERVICE
2222/tcp filtered unknown

Nmap done: 1 IP address (1 host up) scanned in 1.67 seconds

repo · 01-03-2012, 12:22 PM

Are you sure, the ports are correctly forwarded, and the ssh daemon is listening on port 2222?
Do you have a firewall?
Did you restarted the ssh daemon after changing the port?
Can you connect to port 2222 from the server itself?
If all this is correct, I would suggest to contact your provider, to make sure the ports aren't blocked.

Kind regards

newbie14 · 01-03-2012, 12:29 PM

Dear Repo,
Yes I went into the sshd_config file first this line was commented #Post 22 then I uncommented it PORT 2222. Then on the firewall I add another other port 2222. Then I check the iptables is there ready. So then I restart both ssh and also iptables. Then I go to my router and port forward 2222. How to connect to port 2222 from the server itself?So any else I am missing? I might guess the router might be giving a problem here?

asimba · 01-03-2012, 12:48 PM

what about logs - any ssh related activity ?
hoping deny/allow are not fiddled with.

repo · 01-03-2012, 12:55 PM

Quote:

How to connect to port 2222 from the server itself?

Code:

ssh -p 2222 127.0.0.1

Kind regards

repo · 01-03-2012, 12:59 PM

Quote:

2222/tcp filtered unknown

Filtered means that a firewall, filter, or other network obstacle is blocking the port so that Nmap cannot tell whether it is open or closed.

Kind regards

newbie14 · 01-03-2012, 08:30 PM

Dear Asimba,
Which log do you want then I can post it over here? I did not disturb anything allow or deny as this a fresh machine.

newbie14 · 01-03-2012, 08:45 PM

Dear Repo,
I tried this command and below is the results. Does it give any clue what is wrong?

[root@localhost ~]# ssh -p 2222 127.0.0.1
The authenticity of host '[127.0.0.1]:2222 ([127.0.0.1]:2222)' can't be established.
RSA key fingerprint is 19:31:a4:ea:1c:7d:10:6e:12:91:01:ba:15:15:ed:9a.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[127.0.0.1]:2222' (RSA) to the list of known hosts.

asimba · 01-03-2012, 09:48 PM

Quote:

Originally Posted by newbie14

Dear Asimba,
Which log do you want then I can post it over here? I did not disturb anything allow or deny as this a fresh machine.

grep -i ssh /var/log/messages

newbie14 · 01-03-2012, 10:03 PM

Dear Asimba,
Below is the results.

# grep -i ssh /var/log/messages
Jan 1 08:00:33 localhost avahi-daemon[1381]: Loading service file /services/ssh.service.
Jan 1 08:00:33 localhost avahi-daemon[1381]: Service "linux" (/services/ssh.service) successfully established.
Jan 1 08:22:29 localhost avahi-daemon[1364]: Loading service file /services/ssh.service.
Jan 1 08:22:29 localhost avahi-daemon[1364]: Service "linux" (/services/ssh.service) successfully established.
Jan 1 09:43:09 localhost avahi-daemon[1355]: Loading service file /services/ssh.service.
Jan 1 09:43:09 localhost avahi-daemon[1355]: Service "linux" (/services/ssh.service) successfully established.
Jan 1 08:00:55 localhost avahi-daemon[1361]: Loading service file /services/ssh.service.
Jan 1 08:00:57 localhost avahi-daemon[1361]: Service "linux" (/services/ssh.service) successfully established.
Jan 1 09:18:06 localhost avahi-daemon[1384]: Loading service file /services/ssh.service.
Jan 1 09:18:06 localhost avahi-daemon[1384]: Service "linux" (/services/ssh.service) successfully established.

sag47 · 01-03-2012, 10:07 PM

Do you have Pluggable Authentication Modules enabled? I recently encountered a similar dilemma and fixed it.

See my post here for

Code:

UsePAM yes

Are you sure SELinux is disabled? Run getenforce.

You should run

Code:

tail -f /var/log/secure

and then try to authenticate using ssh. It should give you some kind of error message. If that log was not helpful then you could list /var/log for the last written files.

Code:

ls -ltr /var/log

Investigate the log files from the bottom up.

Hopefully you find a solution in my suggestions, if not we'll work from there.
SAM

newbie14 · 01-03-2012, 10:14 PM

Dear Sag47,
Here it is
[root@localhost ~]# getenforce
Disabled
Below is my whole sshd_config file.

Quote:

# $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.

Port 2222
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

# Disable legacy (protocol version 1) support in the server for new
# installations. In future the default will change to require explicit
# activation of protocol 1
Protocol 2

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 1024

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
#AuthorizedKeysCommand none
#AuthorizedKeysCommandRunAs nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no
PasswordAuthentication yes

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
#KerberosUseKuserok yes

# GSSAPI options
#GSSAPIAuthentication no
GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
#UsePAM no
UsePAM yes

# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10
#PermitTunnel no
#ChrootDirectory none

# no default banner path
#Banner none

# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# ForceCommand cvs server

repo · 01-04-2012, 04:40 AM

Quote:

[root@localhost ~]# ssh -p 2222 127.0.0.1
The authenticity of host '[127.0.0.1]:2222 ([127.0.0.1]:2222)' can't be established.
RSA key fingerprint is 19:31:a4:ea:1c:7d:10:6e:12:91:01:ba:15:15:ed:9a.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[127.0.0.1]:2222' (RSA) to the list of known hosts.

So sshd is working and accepting connections on port 2222

Quote:

Starting Nmap 4.75 ( http://nmap.org ) at 2012-01-03 19:10 Central Europe Standard Time
Interesting ports on 82.124.in-addr.arpa.tm.net.my (124.82.40.118):
PORT STATE SERVICE
2222/tcp filtered unknown

This means there is a firewall, filter, or other network obstacle is blocking the port so that Nmap cannot tell whether it is open or closed.
Since you told us the router and the firewall are set to accept/forward port 2222 to port 2222 on the server, the problem is outside your network.
Did you contact your provider to ask if ports are blocked on your connection?

Kind regards

repo · 01-04-2012, 04:46 AM

Quote:

# Authentication:

#LoginGraceTime 2m
PermitRootLogin yes

I would strongly suggest to set

Code:

PermitRootLogin yes

to no

Kind regards

fukawi1 · 01-04-2012, 04:50 AM

Not exactly relevant to the question at hand.
But in your sshd_config, you have PermitRootLogin enabled....
This is generally accepted as being bad practice, and it should be disabled..