LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
Reload this Page SSH Access Denied only with a specific IP address
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 06-15-2015, 01:04 PM   #1
Patel119
LQ Newbie
 
Registered: Jul 2014
Posts: 14

Rep: Reputation: Disabled
SSH Access Denied only with a specific IP address

Starting this morning I have been having issues with "Access Denied" whenever I try to SSH into my server. I only get this message when I'm on my home network, if I tether from my phone then I can log onto SSH without any issues.

I tried looking into iptables, but couldn't really find anything blocking my home IP address.
 
Old 06-15-2015, 03:24 PM   #2
MensaWater
LQ Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, CoreOS, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 7,831
Blog Entries: 15

Rep: Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669
What does iptables show for port 22 and/or ssh service? Most rules aren't set to "block" but rather to "allow" specific things. That is to say you wouldn't necessarily see your home IP blocked iptables but might instead see your tethered IP (or the range that contains it) as "allowed" meaning everything else would be "blocked".

Another possibility is that your ISP is blocking outbound port 22 from your home network. Can you do ssh to anywhere else from home network? If this is the case you could setup an alternate port (e.g. 20022) on sshd on the server then test from home.
 
Old 06-15-2015, 03:57 PM   #3
Patel119
LQ Newbie
 
Registered: Jul 2014
Posts: 14

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by MensaWater View Post
What does iptables show for port 22 and/or ssh service? Most rules aren't set to "block" but rather to "allow" specific things. That is to say you wouldn't necessarily see your home IP blocked iptables but might instead see your tethered IP (or the range that contains it) as "allowed" meaning everything else would be "blocked".

Another possibility is that your ISP is blocking outbound port 22 from your home network. Can you do ssh to anywhere else from home network? If this is the case you could setup an alternate port (e.g. 20022) on sshd on the server then test from home.
The weird thing is that I'm able to log into SSH with my home IP if I restart my server and I log into it RIGHT after it boot ups. I have like a 60 sec grace period.

This is what I get with this command "iptables -L -n".

Chain INPUT (policy ACCEPT)
target prot opt source destination
cphulk all -- 0.0.0.0/0 0.0.0.0/0
cP-Firewall-1-INPUT all -- 0.0.0.0/0 0.0.0.0/0
acctboth all -- 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy ACCEPT)
target prot opt source destination
cP-Firewall-1-INPUT all -- 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
acctboth all -- 0.0.0.0/0 0.0.0.0/0

Chain acctboth (2 references)
target prot opt source destination
tcp -- 209.126.116.174 0.0.0.0/0 tcp dpt:80
tcp -- 0.0.0.0/0 209.126.116.174 tcp spt:80
tcp -- 209.126.116.174 0.0.0.0/0 tcp dpt:25
tcp -- 0.0.0.0/0 209.126.116.174 tcp spt:25
tcp -- 209.126.116.174 0.0.0.0/0 tcp dpt:110
tcp -- 0.0.0.0/0 209.126.116.174 tcp spt:110
icmp -- 209.126.116.174 0.0.0.0/0
icmp -- 0.0.0.0/0 209.126.116.174
tcp -- 209.126.116.174 0.0.0.0/0
tcp -- 0.0.0.0/0 209.126.116.174
udp -- 209.126.116.174 0.0.0.0/0
udp -- 0.0.0.0/0 209.126.116.174
all -- 209.126.116.174 0.0.0.0/0
all -- 0.0.0.0/0 209.126.116.174
all -- 0.0.0.0/0 0.0.0.0/0

Chain cP-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:993
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:2082
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:2078
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:21
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:443
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:2077
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:26
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:8080
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:143
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:995
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:110
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:25
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:2086
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:2087
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:2095
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:465
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:2096
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:3306
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:2083
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53

Chain cphulk (1 references)
target prot opt source destination
DROP all -- 182.100.67.114 0.0.0.0/0 state NEW TIME until date 2015-06-16 20:34:03 UTC
 
Old 06-15-2015, 08:12 PM   #4
Sefyir
Member
 
Registered: Mar 2015
Distribution: Linux Mint
Posts: 634

Rep: Reputation: 316Reputation: 316Reputation: 316Reputation: 316
Quote:
This is what I get with this command "iptables -L -n".
Please use CODE tags when pasting code.

Quote:
"Access Denied"
What is the exact error that is sent?
If it is iptables, it would look something like this if set to send a reject message
Code:
ssh: connect to host ip-address port 22: Connection refused
If your ssh config is setup for rsa key only (which it should be if exposed to internet)
It would look something like this:
Code:
Permission denied (publickey).
 
1 members found this post helpful.
Old 06-15-2015, 08:17 PM   #5
Patel119
LQ Newbie
 
Registered: Jul 2014
Posts: 14

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Sefyir View Post
Please use CODE tags when pasting code.


What is the exact error that is sent?
If it is iptables, it would look something like this if set to send a reject message
Code:
ssh: connect to host ip-address port 22: Connection refused
If your ssh config is setup for rsa key only (which it should be if exposed to internet)
It would look something like this:
Code:
Permission denied (publickey).
I get this with
Code:
ssh -v root@IPAddress
Code:
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to 209.126.116.174 [209.126.116.174] port 22.
debug1: Connection established.
debug1: identity file /Users/MBP/.ssh/id_rsa type -1
debug1: identity file /Users/MBP/.ssh/id_rsa-cert type -1
debug1: identity file /Users/MBP/.ssh/id_dsa type -1
debug1: identity file /Users/MBP/.ssh/id_dsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 38:3c:d9:d8:4c:44:65:65:72:e9:c2:5a:12:89:f2:5d
debug1: Host '209.126.116.174' is known and matches the RSA host key.
debug1: Found key in /Users/MBP/.ssh/known_hosts:2
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/MBP/.ssh/id_rsa
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /Users/MBP/.ssh/id_dsa
debug1: Next authentication method: password
root@209.126.116.174's password: 
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
 
Old 06-15-2015, 10:08 PM   #6
Sefyir
Member
 
Registered: Mar 2015
Distribution: Linux Mint
Posts: 634

Rep: Reputation: 316Reputation: 316Reputation: 316Reputation: 316
Code:
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/MBP/.ssh/id_rsa
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /Users/MBP/.ssh/id_dsa
debug1: Next authentication method: password
root@209.126.116.174's password: 
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
So it looks like it will accept a public key or password.
It attempts two private keys which fail and then does password when then fails.
This is your sshd config, and not your iptables setup.

My prediction with the current information is this:
On your sshd config you have this line set (generally the default)
Code:
PermitRootLogin without-password
This means root logins can login as long as it's only done with a key. Attempting to login with a password as root will fail - despite being setup to permit logins with password or key
Quote:
I only get this message when I'm on my home network, if I tether from my phone then I can log onto SSH without any issues.
Pasting the ssh -v of your login with the login "that works" could help identify the issue as well, to see why it works and the other fails.

Please paste your /etc/ssh/sshd_config file as well since it's not your iptables but sshd config file causing the permission denied.

Also, logging in with root is a really bad idea. Logging in as a normal user and using su to switch to root is much better.
Last edited by Sefyir; 06-15-2015 at 10:10 PM.
 
1 members found this post helpful.
Old 06-15-2015, 10:41 PM   #7
Patel119
LQ Newbie
 
Registered: Jul 2014
Posts: 14

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Sefyir View Post
Code:
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/MBP/.ssh/id_rsa
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /Users/MBP/.ssh/id_dsa
debug1: Next authentication method: password
root@209.126.116.174's password: 
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
So it looks like it will accept a public key or password.
It attempts two private keys which fail and then does password when then fails.
This is your sshd config, and not your iptables setup.

My prediction with the current information is this:
On your sshd config you have this line set (generally the default)
Code:
PermitRootLogin without-password
This means root logins can login as long as it's only done with a key. Attempting to login with a password as root will fail - despite being setup to permit logins with password or key

Pasting the ssh -v of your login with the login "that works" could help identify the issue as well, to see why it works and the other fails.

Please paste your /etc/ssh/sshd_config file as well since it's not your iptables but sshd config file causing the permission denied.

Also, logging in with root is a really bad idea. Logging in as a normal user and using su to switch to root is much better.

Here's the sshd_config.
Code:
#	$OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options change a
# default value.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

# Disable legacy (protocol version 1) support in the server for new
# installations. In future the default will change to require explicit
# activation of protocol 1
Protocol 2

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 1024

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile     .ssh/authorized_keys
#AuthorizedKeysCommand none
#AuthorizedKeysCommandRunAs nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no
PasswordAuthentication yes

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
#KerberosUseKuserok yes

# GSSAPI options
GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
#UsePAM no
UsePAM yes

# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none

# no default banner path
#Banner none

# override default of no subsystems
Subsystem	sftp    /usr/libexec/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#	X11Forwarding no
#	AllowTcpForwarding no
#	ForceCommand cvs server
I tethered my phone and tried to login, but oddly enough I got access denied, here's the ssh -v for it:
Code:
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to 209.126.116.174 [209.126.116.174] port 22.
debug1: Connection established.
debug1: identity file /Users/MBP/.ssh/id_rsa type -1
debug1: identity file /Users/MBP/.ssh/id_rsa-cert type -1
debug1: identity file /Users/MBP/.ssh/id_dsa type -1
debug1: identity file /Users/MBP/.ssh/id_dsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 38:3c:d9:d8:4c:44:65:65:72:e9:c2:5a:12:89:f2:5d
debug1: Host '209.126.116.174' is known and matches the RSA host key.
debug1: Found key in /Users/MBP/.ssh/known_hosts:2
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/MBP/.ssh/id_rsa
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /Users/MBP/.ssh/id_dsa
debug1: Next authentication method: password
root@209.126.116.174's password: 
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
root@209.126.116.174's password:
Thanks, I will immediately stop using root after I get this issue resolved.

Another thing since tethering my phone doesn't work. I can still get SSH access to my server, but I have to reboot the server and I have around 30-60 seconds right after it boots up to log in via SSH and then it works.

Also, thank you very much for help me so far!!
 
Old 06-15-2015, 11:39 PM   #8
Sefyir
Member
 
Registered: Mar 2015
Distribution: Linux Mint
Posts: 634

Rep: Reputation: 316Reputation: 316Reputation: 316Reputation: 316
Try running through the solutions here:
http://unix.stackexchange.com/questi...authentication
Especially this answer if possible since it may tell us why the server is saying no.

Code:
debug1: Roaming not allowed by server
#HostbasedAuthentication no
Also, you can try this as well
http://crunchbang.org/forums/viewtopic.php?id=30205

Unfortunately the debug is a little cryptic but your output is similar in problem to the above.
 
Old 06-16-2015, 12:40 AM   #9
Patel119
LQ Newbie
 
Registered: Jul 2014
Posts: 14

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Sefyir View Post
Try running through the solutions here:
http://unix.stackexchange.com/questi...authentication
There is no directory to .ssh. I'm able to see everything inside of "~" and .ssh is not there.

Quote:
Especially this answer if possible since it may tell us why the server is saying no.
This is the debug log for /usr/sbin/sshd -d
Code:
debug1: sshd version OpenSSH_5.3p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
Quote:
Code:
debug1: Roaming not allowed by server
#HostbasedAuthentication no
Also, you can try this as well
http://crunchbang.org/forums/viewtopic.php?id=30205

Unfortunately the debug is a little cryptic but your output is similar in problem to the above.
I did make these changes, but still having issues.
 
Old 06-16-2015, 09:02 AM   #10
Sefyir
Member
 
Registered: Mar 2015
Distribution: Linux Mint
Posts: 634

Rep: Reputation: 316Reputation: 316Reputation: 316Reputation: 316
Code:
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
This means you have started the sshd process and it is waiting for a connection. Once you get to this point you should attempt to connect to it from the client. Then server side debug details will appear. Since no connection was made, there's nothing to read there.

Quote:
There is no directory to .ssh. I'm able to see everything inside of "~" and .ssh is not there.
In terminal, what happens when you type?
Code:
ls ~/.ssh/
If you truly have no .ssh file on your server (odd!) create one with 700 permissions.
Code:
mkdir ~/.ssh && chmod 700 ~/.ssh
But - first get the sshd debug info.

Edit:

This is what a initial connection should appear like (the first several lines)
I also ran this command to bind it to port 9876 so it stays out of the way of 22.
Code:
Server listening on :: port 9876.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 192.xxx.x.xx port 36961 on 192.xxx.x.xx port 9876
...
Code:
sudo /usr/sbin/sshd -dp 9876
to connect from ssh client..
Code:
ssh username@host -p 9876
Last edited by Sefyir; 06-16-2015 at 10:04 AM.
 
Old 06-17-2015, 04:43 PM   #11
Patel119
LQ Newbie
 
Registered: Jul 2014
Posts: 14

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Sefyir View Post
Code:
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
This means you have started the sshd process and it is waiting for a connection. Once you get to this point you should attempt to connect to it from the client. Then server side debug details will appear. Since no connection was made, there's nothing to read there.


In terminal, what happens when you type?
Code:
ls ~/.ssh/
If you truly have no .ssh file on your server (odd!) create one with 700 permissions.
Code:
mkdir ~/.ssh && chmod 700 ~/.ssh
But - first get the sshd debug info.

Edit:

This is what a initial connection should appear like (the first several lines)
I also ran this command to bind it to port 9876 so it stays out of the way of 22.
Code:
Server listening on :: port 9876.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 192.xxx.x.xx port 36961 on 192.xxx.x.xx port 9876
...
Code:
sudo /usr/sbin/sshd -dp 9876
to connect from ssh client..
Code:
ssh username@host -p 9876
So yesterday I tried to SSH and it worked! I tried it again today and it didn't work, but today it worked with my tethered phone.

Here's the code for
Code:
/usr/sbin/sshd -d
Code:
root@pacific1683 [~]# /usr/sbin/sshd -d 
debug1: sshd version OpenSSH_5.3p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 73.209.238.153 port 64310
debug1: Client protocol version 2.0; client software version PuTTY_Release_0.63
debug1: no match: PuTTY_Release_0.63
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: permanently_set_uid: 74/74
debug1: list_hostkey_types: ssh-rsa,ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server aes256-ctr hmac-sha2-256 none
debug1: kex: server->client aes256-ctr hmac-sha2-256 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user root service ssh-connection method none
debug1: attempt 0 failures 0
debug1: PAM: initializing for "root"
debug1: PAM: setting PAM_RHOST to "c-73-209-238-153.hsd1.il.comcast.net"
debug1: PAM: setting PAM_TTY to "ssh"
debug1: userauth-request for user root service ssh-connection method publickey
debug1: attempt 1 failures 0
debug1: test whether pkalg/pkblob are acceptable
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /root/.ssh/authorized_keys
debug1: Could not open authorized keys '/root/.ssh/authorized_keys': No such file or directory
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /root/.ssh/authorized_keys2
debug1: Could not open authorized keys '/root/.ssh/authorized_keys2': No such file or directory
debug1: restore_uid: 0/0
Failed publickey for root from 73.209.238.153 port 64310 ssh2
debug1: userauth-request for user root service ssh-connection method password
debug1: attempt 2 failures 1
debug1: PAM: password authentication failed for root: Authentication failure
Failed password for root from 73.209.238.153 port 64310 ssh2
debug1: userauth-request for user root service ssh-connection method password
debug1: attempt 3 failures 2
debug1: PAM: password authentication failed for root: Authentication failure
Failed password for root from 73.209.238.153 port 64310 ssh2
 
Old 06-17-2015, 06:55 PM   #12
Sefyir
Member
 
Registered: Mar 2015
Distribution: Linux Mint
Posts: 634

Rep: Reputation: 316Reputation: 316Reputation: 316Reputation: 316
Thank you for getting the log data

A few things I noticed:
Code:
Connection from 73.209.xxx.xxx port 64310
debug1: Client protocol version 2.0; client software version PuTTY_Release_0.63
...
debug1: trying public key file /root/.ssh/authorized_keys
debug1: Could not open authorized keys '/root/.ssh/authorized_keys': No such file or directory
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /root/.ssh/authorized_keys2
debug1: Could not open authorized keys '/root/.ssh/authorized_keys2': No such file or directory
debug1: restore_uid: 0/0
Failed publickey for root from 73.209.xxx.xxx port 64310 ssh2
debug1: userauth-request for user root service ssh-connection method password
debug1: attempt 2 failures 1
debug1: PAM: password authentication failed for root: Authentication failure
Failed password for root from 73.209.xxx.xxx port 64310 ssh2
debug1: userauth-request for user root service ssh-connection method password
debug1: attempt 3 failures 2
debug1: PAM: password authentication failed for root: Authentication failure
Failed password for root from 73.209.xxx.xxx port 64310 ssh2
Are you manually putting in the password? Because it looks like it attempts to view the authorized key file (pub key authentication) which fails (1/3), then attempts to use password auth, which is incorrect twice (2/3, 3/3) and then disconnects.
 
Old 06-17-2015, 07:39 PM   #13
Patel119
LQ Newbie
 
Registered: Jul 2014
Posts: 14

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Sefyir View Post
Thank you for getting the log data

A few things I noticed:
Code:
Connection from 73.209.xxx.xxx port 64310
debug1: Client protocol version 2.0; client software version PuTTY_Release_0.63
...
debug1: trying public key file /root/.ssh/authorized_keys
debug1: Could not open authorized keys '/root/.ssh/authorized_keys': No such file or directory
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /root/.ssh/authorized_keys2
debug1: Could not open authorized keys '/root/.ssh/authorized_keys2': No such file or directory
debug1: restore_uid: 0/0
Failed publickey for root from 73.209.xxx.xxx port 64310 ssh2
debug1: userauth-request for user root service ssh-connection method password
debug1: attempt 2 failures 1
debug1: PAM: password authentication failed for root: Authentication failure
Failed password for root from 73.209.xxx.xxx port 64310 ssh2
debug1: userauth-request for user root service ssh-connection method password
debug1: attempt 3 failures 2
debug1: PAM: password authentication failed for root: Authentication failure
Failed password for root from 73.209.xxx.xxx port 64310 ssh2
Are you manually putting in the password? Because it looks like it attempts to view the authorized key file (pub key authentication) which fails (1/3), then attempts to use password auth, which is incorrect twice (2/3, 3/3) and then disconnects.

Yes, I am putting in the password manually.

Here's ssh -v that works since I tethered it with my phone.

Code:
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to 209.126.116.174 [209.126.116.174] port 22.
debug1: Connection established.
debug1: identity file /Users/MBP/.ssh/id_rsa type -1
debug1: identity file /Users/MBP/.ssh/id_rsa-cert type -1
debug1: identity file /Users/MBP/.ssh/id_dsa type -1
debug1: identity file /Users/MBP/.ssh/id_dsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 38:3c:d9:d8:4c:44:65:65:72:e9:c2:5a:12:89:f2:5d
debug1: Host '209.126.116.174' is known and matches the RSA host key.
debug1: Found key in /Users/MBP/.ssh/known_hosts:2
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,hostbased
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/MBP/.ssh/id_rsa
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey,password,hostbased
debug1: Trying private key: /Users/MBP/.ssh/id_dsa
debug1: Next authentication method: password
root@209.126.116.174's password: 
debug1: Authentication succeeded (password).
Authenticated to 209.126.116.174 ([209.126.116.174]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
Last login: Wed Jun 17 23:39:57 2015 from 172.56.12.172
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
ssh access denied bino25 Linux - Newbie 11 10-23-2011 11:35 PM
[SOLVED] how to monitor specific ip address in squid access.log struggled_newbie Linux - Newbie 2 06-21-2010 07:05 PM
Firewall access for a specific mac address mfitzpat Linux - Networking 3 01-07-2010 09:24 AM
Restricting access to a specific port by MAC address caps_phisto Linux - Networking 3 10-23-2006 01:55 PM
Samba: Access denied from a specific machine SonJelfn Linux - Software 1 04-15-2005 05:30 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 11:12 AM.

Contact Us - Advertising Info - Rules - Privacy - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration