Solved

SSH times out before making connection

Posted on 2008-06-18
12
889 Views
Last Modified: 2010-07-27
I am trying to SSH into a new Cent OS 5 server from my home office, and the connection times out before completing.

I have done the following:

* Assigned the server an IP on the block where it sits
* Made sure that /etc/resolv.conf points to valid DNS servers
* Assigned the firewall to allow SSH on this IP (port 22)

I can remotely SSH into other servers in the block, and then SSH to this one.
But if I attempt to remotely SSH directly to this server, I get
"ssh: connect to host XXX.XXX.XXX.XXX port 22: Operation timed out

/var/log/secure has no indication it ever SAW the connection attempt.


0
Comment
Question by:shambright
  • 6
  • 4
  • 2
12 Comments
 
LVL 7

Expert Comment

by:namol
ID: 21816681
Are there any messages showing up in /var/log/messages from iptables? Also what commands did you use to add the rules to allow ssh to iptables? These will allow incoming and outgoing ssh communications on the server:
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
0
 

Author Comment

by:shambright
ID: 21817247
There is nothing in /var/log/messages regarding iptables

I can connect via SSH from another server in the network (behind the firewall) but not from the outside.


0
 
LVL 7

Expert Comment

by:namol
ID: 21818437
does your firewall allow for ssh to come in? If not you'll have to open it up for port 22 to forward traffic to the correct hosts.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:shambright
ID: 21818456
I currently have all ports open for that particular IP. Port 22 was specified in my original post and while troubleshooting, I opened all ports on the router.

Further, I can ping the server with no problem from the router itself.

I added your "iptables" suggestions, but nothing changed. Besides, I was able to SSH from inside the firewall, so it is not a question of the server not allowing it.

I am now thinking it is a problem with CentOS - or a problem communicating with my Mac Laptop.

0
 
LVL 7

Expert Comment

by:namol
ID: 21818560
So you setup a forward for port 22 to the centos machine? If you can hit it internally then there is something externally or between the outside and the server that is blocking the connection.
0
 

Author Comment

by:shambright
ID: 21818959
Right...

I will wait and see if anyone else has any suggestions for where to look.
0
 
LVL 7

Expert Comment

by:namol
ID: 21818988
can you hit any of the other servers from outside of the network?
0
 

Author Comment

by:shambright
ID: 21821526
Namol,

With all due respect, you keep asking questions and making comments that I answered in my posts.
I can remotely SSH to all of the other servers, just not the one I need.
0
 
LVL 14

Expert Comment

by:agriesser
ID: 21833333
Try to connect to port 22 on this machine without having SSH listening on this port.
To do this, SSH into this machine via another machine in this block (you said that this works for you already), stop the SSH server (the SSH session you're currently connected with won't quit when the server is down) and start nc (the TCP/IP swiss army knife) on this port by running the following command as root on this machine (you might need to install "nc", but usually it's installed on all common linux distributions by default):

nc -l -p 22

Now try to connect to port 22 from outside with telnet, e.g.:

telnet 123.234.232.132 22

and see if you can get a connection.
Try to type text into the telnet window and you should see this text appear on the terminal where you started nc.

If this works, you can at least be sure that the firewall/NAT/PAT rule is working properly.

After you've done this, you can quit nc with CTRL-C and don't forget to restart your SSH server, otherwise no future connection attempts can be made to this server.
0
 

Author Comment

by:shambright
ID: 21833857
Thanks for the reply.

Your command did not work as written.

Trying

nc -l -p 22 22

says 'Cannot use -p and -l'

I tried just

nc -l 22

...and this did not show any result with telnet from the remote site.
BUT I did try it from INSIDE the firewall, and it worked as you described.

I guess the problem is still at the firewall.

0
 
LVL 14

Expert Comment

by:agriesser
ID: 21833960
Out of my `man nc` (version 1.10-32 on Debian):

NC(1)                                                                    NC(1)

NAME
       nc - TCP/IP swiss army knife

SYNOPSIS
       nc [-options] hostname port[s] [ports] ...
       nc -l -p port [-options] [hostname] [port]

So either your netcat version is newer or older than mine, because mine supports -p and -l on one command line.

I just looked at the previous replies and saw namol suggesting:

iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT

Do you have iptables rules running on this host? If so, read on:

This won't work for outgoing connections, because new SSH sessions established from this host will not be generated at source port 22, neither will the replies to incoming ssh connections be initiated from source port 22.

If you have stateful filtering enabled in your iptables configuration, make sure to add the following iptables rule before all other rules:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

If you're limiting your machine in terms of outbound connections, make sure to add the related rule to the output chain too:

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

But personally, I wouldn't apply rules to the OUTPUT chain if there's no really good reason for it.

Could I see the output of `iptables -L -n -v` on the CentOS box that doesn't accept SSH connections?
0
 

Accepted Solution

by:
shambright earned 0 total points
ID: 21834047
Problem Solved.

I had an incorrect netmask (too narrow)  at:

/etc/sysconfig/network-scripts/ifcfg-eth0

even though the 'ifconfig' command showed the correct one.

Changing the file and rebooting brought everything online.

Annoying, but finished. Thanks for your suggestions.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
fedora linux on laptop - setup sendmail - or some kind of email 5 66
cannot rename datastore 3 99
awk variable in printf 1 43
Certificate Request CentOS/Apache 1 25
I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
The purpose of this article is to demonstrate how we can use conditional statements using Python.
Viewers will learn how to properly install and use Secure Shell (SSH) to work on projects or homework remotely. Download Secure Shell: Follow basic installation instructions: Open Secure Shell and use "Quick Connect" to enter credentials includi…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question