LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices



Reply
 
Search this Thread
Old 03-13-2007, 12:53 PM   #1
cucolin@
Member
 
Registered: Nov 2003
Location: USA
Distribution: Ubuntu, Fedora
Posts: 415

Rep: Reputation: 31
Question ssh: connection to host port: 22: Connection timed out lost connection


We have 2 linux boxes on 2 different floors. I'm able to transfer files from Box A to Box B, but not from box B to box A. When I try to transfer files from B to A I get:

ssh: connect to host 10.0.0.1 port 22: Connection timed out lost connection

What might be the problem here?? I'm able to ping from both machines: A to B and B to A with no errors.

Thanks
 
Old 03-13-2007, 01:23 PM   #2
MensaWater
Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 6,028
Blog Entries: 5

Rep: Reputation: 791Reputation: 791Reputation: 791Reputation: 791Reputation: 791Reputation: 791Reputation: 791
Could be:
a) You're not running sshd on Box A.
b) You're running a firewall somewhere that is blocking inbound port 22 to Box A.

On Box A run:
lsof -i :22

You should see (among other things) a line like the following showing it is LISTENing for connections. If not you may need to start your sshd or at least verify /etc/xinetd.d has it started.
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sshd 1781 root 3u IPv6 4892 TCP *:ssh (LISTEN)

If above is running you can try "telnet <box a> 22" to see if this times out as well. If so it would indicate something isn't allowing connections even though you're LISTENing for them.

Possible culprits:
iptables (or some other firewall software) on Box A. If iptables you can run "service iptables stop" then test it. If it works you know it was iptables. You'd then need to figure out a rule to allow port 22 from Box B OR leave iptables off. (You should make a rule. Command to restart iptables is "service iptables start". Turn it off just to see if it is the problem.)

SELinux on Box A. SELinux is a new NSA sponsored security sort of like a firewall on steroids and it is a huge pain for most people. Most people just disable it.

A physical switch/firewall between Box A and Box B that prevents port 22 traffic to Box A. For this you'd have to get a Network person involved if you're not the one who administers these. Typically between floors in buildings there are "VLANS" that do this kind of blocking.
 
Old 03-13-2007, 03:54 PM   #3
cucolin@
Member
 
Registered: Nov 2003
Location: USA
Distribution: Ubuntu, Fedora
Posts: 415

Original Poster
Rep: Reputation: 31
jlighter, thanks a lot!! It seems that most of the greatest problems are caused by a stupid/simple mistake. I forgot I have installed firestarter firewall on box A and it was blocking port 22. Thanks a lot, I don't know why I didn't check for that first. Is firestarter configurable by the command line also? I had to go to box A and allow port 22 using the GUI.

Thanks
 
Old 03-13-2007, 04:14 PM   #4
MensaWater
Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 6,028
Blog Entries: 5

Rep: Reputation: 791Reputation: 791Reputation: 791Reputation: 791Reputation: 791Reputation: 791Reputation: 791
I haven't used Firestarter but I gather from other comments I've seen that it is just a GUI front end for iptables. Since you can configure iptables from command line the answer would be yes.

"iptables -L" will list your current rules from command line.

In UNIX/Linux almost everything can be done from the command line even if it is sometimes easier to do from GUI. (Some GUI utilities even have logging modes that will show you the command line they're running behind the scenes.) This is mainly to allow for scripting tasks. I've been doing UNIX for so long it often doesn't even occur to me to look for a GUI solution even on the systems where I have KDE or Gnome running.

Last edited by MensaWater; 03-13-2007 at 04:15 PM.
 
Old 11-22-2011, 07:15 AM   #5
dep
LQ Newbie
 
Registered: May 2010
Distribution: ubuntu
Posts: 2

Rep: Reputation: 0
Unhappy

I've got this problem too. Ping works, but no connections can be made.

Quote:
Originally Posted by MensaWater View Post
a) You're not running sshd on Box A.
I double-checked, then ran it with the -d switch to observe the output. Nothing happens when I try to connect from a remote machine. I can ssh from localhost, however!

Quote:
Originally Posted by MensaWater View Post
b) You're running a firewall somewhere that is blocking inbound port 22 to Box A.
My network topology is such that box A and box B are separated only by a wireless router, where the iptables rules are set to allow all within the LAN:
Code:
#PORT FORWARDS
iptables -I FORWARD -d 192.168.1.129 -j ACCEPT 
iptables -I FORWARD -d 192.168.1.121 -j ACCEPT
Quote:
Originally Posted by MensaWater View Post
On Box A run:
lsof -i :22
Shows nothing (unless I'm locally connected to an SSH session; however,
Code:
netstat -ntl |grep :22
shows tcp and tcp6 LISTENing status for the local IP of box A:
Quote:
tcp 0 0 192.168.1.129:22 0.0.0.0:* LISTEN
Quote:
Originally Posted by MensaWater View Post
If above is running you can try "telnet <box a> 22" to see if this times out as well.
It does.

Quote:
Originally Posted by MensaWater View Post
Possible culprits:
iptables (or some other firewall software) on Box A.
No firewall running on box A - iptables yes this was it - see http://serverfault.com/questions/197...ion-timed-out:
Quote:
Chain INPUT (policy DROP)
target prot opt source destination
ufw-before-logging-input all -- anywhere anywhere
ufw-before-input all -- anywhere anywhere
ufw-after-input all -- anywhere anywhere
ufw-after-logging-input all -- anywhere anywhere
ufw-reject-input all -- anywhere anywhere
ufw-track-input all -- anywhere anywhere

Chain FORWARD (policy DROP)
target prot opt source destination
ufw-before-logging-forward all -- anywhere anywhere
ufw-before-forward all -- anywhere anywhere
ufw-after-forward all -- anywhere anywhere
ufw-after-logging-forward all -- anywhere anywhere
ufw-reject-forward all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ufw-before-logging-output all -- anywhere anywhere
ufw-before-output all -- anywhere anywhere
ufw-after-output all -- anywhere anywhere
ufw-after-logging-output all -- anywhere anywhere
ufw-reject-output all -- anywhere anywhere
ufw-track-output all -- anywhere anywhere

Chain ufw-after-forward (1 references)
target prot opt source destination

Chain ufw-after-input (1 references)
target prot opt source destination
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-ns
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-dgm
ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:netbios-ssn
ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:microsoft-ds
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootps
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootpc
ufw-skip-to-policy-input all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix `[UFW BLOCK] '

Chain ufw-after-logging-input (1 references)
target prot opt source destination

Chain ufw-after-logging-output (1 references)
target prot opt source destination

Chain ufw-after-output (1 references)
target prot opt source destination

Chain ufw-before-forward (1 references)
target prot opt source destination
ufw-user-forward all -- anywhere anywhere

Chain ufw-before-input (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ufw-logging-deny all -- anywhere anywhere state INVALID
DROP all -- anywhere anywhere state INVALID
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp source-quench
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc
ufw-not-local all -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere 239.255.255.250 udp dpt:1900
ufw-user-input all -- anywhere anywhere

Chain ufw-before-logging-forward (1 references)
target prot opt source destination

Chain ufw-before-logging-input (1 references)
target prot opt source destination

Chain ufw-before-logging-output (1 references)
target prot opt source destination

Chain ufw-before-output (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ufw-user-output all -- anywhere anywhere

Chain ufw-logging-allow (0 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix `[UFW ALLOW] '

Chain ufw-logging-deny (2 references)
target prot opt source destination
RETURN all -- anywhere anywhere state INVALID limit: avg 3/min burst 10
LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix `[UFW BLOCK] '

Chain ufw-not-local (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere ADDRTYPE match dst-type LOCAL
RETURN all -- anywhere anywhere ADDRTYPE match dst-type MULTICAST
RETURN all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST
ufw-logging-deny all -- anywhere anywhere limit: avg 3/min burst 10
DROP all -- anywhere anywhere

Chain ufw-reject-forward (1 references)
target prot opt source destination

Chain ufw-reject-input (1 references)
target prot opt source destination

Chain ufw-reject-output (1 references)
target prot opt source destination

Chain ufw-skip-to-policy-forward (0 references)
target prot opt source destination
DROP all -- anywhere anywhere

Chain ufw-skip-to-policy-input (7 references)
target prot opt source destination
DROP all -- anywhere anywhere

Chain ufw-skip-to-policy-output (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain ufw-track-input (1 references)
target prot opt source destination

Chain ufw-track-output (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere state NEW
ACCEPT udp -- anywhere anywhere state NEW

Chain ufw-user-forward (1 references)
target prot opt source destination

Chain ufw-user-input (1 references)
target prot opt source destination

Chain ufw-user-limit (0 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning prefix `[UFW LIMIT BLOCK] '
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain ufw-user-logging-forward (0 references)
target prot opt source destination

Chain ufw-user-logging-input (0 references)
target prot opt source destination

Chain ufw-user-logging-output (0 references)
target prot opt source destination

Chain ufw-user-output (1 references)
target prot opt source destination
Quote:
Originally Posted by MensaWater View Post
If iptables you can run "service iptables stop" then test it.
Strangely, iptables was not recognized by the services command.

Quote:
Originally Posted by MensaWater View Post
SELinux on Box A.
Nope, Ubuntu 11.10. For the record, this (among other things) worked perfectly alright before the upgrade to Oneiric.

Quote:
Originally Posted by MensaWater View Post
A physical switch/firewall between Box A and Box B that prevents port 22 traffic to Box A.
There's a router running dd-wrt in between (as I said, set not to block anything), but with syslogd not logging anything when I try to connect, how can I investigate this further?

Last edited by dep; 11-24-2011 at 11:19 AM. Reason: iptables
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
ssh connection lost kpachopoulos Linux - General 2 11-05-2005 07:07 PM
SuseFirewall2 and external SSH access connection timed out usmanaziz Linux - Distributions 1 09-03-2004 04:15 AM
Lost connection to internet after a while, but able to ssh to gateway Covel Linux - Networking 6 07-11-2004 05:38 PM
exim connection timed out error(host lookup is done fine) rmanocha Linux - Software 2 06-20-2004 01:40 AM
ssh: Connection timed out. [from school] nixel Linux - Networking 2 05-19-2004 01:21 PM


All times are GMT -5. The time now is 08:31 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration