I'm a linux network newbie so please bear with me. Also, if this isn't the right forum, please let me know.

My RH7.3 server is located in a DMZ. Access to the server is via SSH and HTTPS. I don't believe the server has any firewall rules set up as another machine on the DMZ does all that for me.

A couple of times per day access via SSH / HTTPS suddenly stops. There's nothing in the system log that indicates why.

The strange thing is, restarting the SSH server doesn't make it work. Rebooting does, as does restarting the network.

Any ideas what could be the cause? I'm not sure what sort of other info I can provide.
Regards
Mark

Sure, what connects to what in what order?

Regards,
Peter

I'm sorry Peter, I don't understand the question - could you expand a bit?
Regards
Mark

Oops...
How are the pc's connected?
A descripion of which machines you must go through to get to your server in the DMZ, etc.

Regards,
Peter

The server is access through a firewall - apparently we use Checkpoint Firewall 1 software.

The DMZ is on a different network segment (I'm told).
Does this answer your question?

I've double-checked with the IT team and the firewall is not being modified during the periods where I can and cannot gain access to our server so I'm trying to the firewall from the equation.

I'd start by placing a LOG entry in the firewall rules of your server.
Try,
iptables -t nat -A PREROUTING -j LOG --log-level 6 --log-prefix "incoming "
and look for the messages in /var/log/messages.

Look for a period of no activity. This means netfilter didn't get any packets from the nic. If this is the case, set up a cronttab entry to run every hour (or less) to scan yourself with nmap or similar, and look for these in your own pc log files.
cronttab -e
0 * * * * /usr/bin/nmap -sS -p 22,80,110 -P0 -r -n yr.ip.num.ber > /var/log/scan
to check the path outward. (man cronttab)
If you find your server isn't sending, check the connection with another server on the DMZ, and if it works ok, get another patch cord or NIC.
(if you can get the permission, try the nmap thing on some known open ports on servers inside the DMZ as well to cross reference what is & isn't working)

Regards,
Peter

Hi Peter
I've set up the logging as mentioned. There is no period of activity reported. There's network activity for every minute of every day for the last 2 days.
Also, when ssh and https "hung" I was able to access other machines via the console.

Any further thoughts?
Regards,
Mark

Hmmm?

What are the connections while your ssh/https hangs?

Regards,
Peter

Hi Peter,
Sorry it's taken a bit of time to reply...
Here's the output from a "netstat -punta" command performed at the point when it failed.
Regards
Mark

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:32768 0.0.0.0:* LISTEN 618/rpc.statd
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 1094/mysqld
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 590/portmap
tcp 0 0 0.0.0.0:6000 0.0.0.0:* LISTEN 3352/X
tcp 0 0 0.0.0.0:10000 0.0.0.0:* LISTEN 1105/perl
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2239/sshd
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 878/master
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 1040/httpd
tcp 0 0 192.168.1.7:22 10.2.64.179:1025 ESTABLISHED 20016/sshd
udp 0 0 0.0.0.0:32768 0.0.0.0:* 618/rpc.statd
udp 0 0 0.0.0.0:10000 0.0.0.0:* 1105/perl
udp 0 0 0.0.0.0:111 0.0.0.0:* 590/portmap