Hey folks:

I setup a sshd server on my FC3 machine, and I had no problems. However, I disabled a few services relating to NFS, which I had been playing with, and now I keep getting the following error:

Is there some walkthrough site for SSH including what services needed, open ports, and examples of appropriate hosts.allow and hosts.deny? I haven't had much luck, so I thought you folks might be able to push me in the right direction...

try using tcpdump to analyze the problem, ie watch the packets as you try to connect. as i recall you only need port 22 open. possibly port 53 for name resolution (i need this open to output for sendmail to work, iirc). and for services, all you need is sshd.

Dumb question, but should I run tcpdump on the client or the server?

both? theoretically you should see the same thing on both, but i wouldn't take it for granted. also read man tcpdump just to get a feel for some of the options you can use. for instance

tcpdump -i eth1 -n

will listen on eth1 and provide ip addresses instead of domain names (iirc). i vaguely remember something about promiscuous mode, but i forget whether that's related to when you bring the interface up or when you run tcpdump.

oh, and either nmap or netstat (or both, hehe) can help you verify that you have a service (sshd) listening on a port (22). for instance, i think

netstat -anp

when run on the server, would show all the services. you want to look at the ones near the top, with LISTEN in the description.

Here's what I got.

ETA: One moment, didn't see your previous post. Let me get that output.

How much of the output (from tcpdump) is relevant? There doesn't seem to be an end to it...

yeah, tcpdump will keep going until you tell it to stop. what you're looking for is connections accross the ip addresses you're interested in. you'll see every packet that gets transmitted on a given interface, so keep your eyes open for the ip addresses. if you have two terminals open, one running tcpdump -i eth0 -n, and the in the other you ping www.google.com, you'd first see a query go out on port 53 to resolve www.google.com into an ip address. you'd also see the response come back. there will probably be several packets that are just part of that transaction.

so anyway, watch which ports are used and make sure they're open in your firewall, and that you have the appropriate service listed by netstat. oh, and the UNIX ones at the bottom you can ignore, they're just on your local machine. it's the top ones, tcp and udp sockets, and even then only the ones that have LISTEN next to them. i've got a mail server, and the only services netstat lists are

sshd - tcp 22
smtp - tcp 25
sendmail accept - tcp 587
inetd - tcp 143

i don't know what 587 is for, but i have it closed off in my firewall, so it must not be necessary. 25 is for smtp and 143 is for imap (which is called by inetd). i don't need anything else open in order to ssh in. on my firewall i've got ports 22, 25, and 143 open to INPUT and 25 and 53 (for name resolution) open to OUTPUT. i also allow all packets with state RELATED or ESTABLISHED.

Cool. Thanks for the explanation.

Here's the output from the server on my first attempt, running the command "ssh 192.168.1.3."

And here's the output from the client:

So there are some dropped packets obviously. I thought it'd be useful to run the same ssh command with verbose output.

Here's the server this time:

And here's the client this time:

I'm not sure what to make of this. Any thoughts anyone?