Solved

SSH times out before making connection

Posted on 2008-06-18
12
890 Views
Last Modified: 2010-07-27
I am trying to SSH into a new Cent OS 5 server from my home office, and the connection times out before completing.

I have done the following:

* Assigned the server an IP on the block where it sits
* Made sure that /etc/resolv.conf points to valid DNS servers
* Assigned the firewall to allow SSH on this IP (port 22)

I can remotely SSH into other servers in the block, and then SSH to this one.
But if I attempt to remotely SSH directly to this server, I get
"ssh: connect to host XXX.XXX.XXX.XXX port 22: Operation timed out

/var/log/secure has no indication it ever SAW the connection attempt.


0
Comment
Question by:shambright
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 4
  • 2
12 Comments
 
LVL 7

Expert Comment

by:namol
ID: 21816681
Are there any messages showing up in /var/log/messages from iptables? Also what commands did you use to add the rules to allow ssh to iptables? These will allow incoming and outgoing ssh communications on the server:
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
0
 

Author Comment

by:shambright
ID: 21817247
There is nothing in /var/log/messages regarding iptables

I can connect via SSH from another server in the network (behind the firewall) but not from the outside.


0
 
LVL 7

Expert Comment

by:namol
ID: 21818437
does your firewall allow for ssh to come in? If not you'll have to open it up for port 22 to forward traffic to the correct hosts.
0
Are You Using the Best Web Development Editor?

The worlds of web hosting and web development are constantly evolving. Every year we see design trends change, coding standards adapt and new frameworks/CMS created. With such a quick pace of change it’s easy to get lost trying to keep up.

See if your editor made the list.

 

Author Comment

by:shambright
ID: 21818456
I currently have all ports open for that particular IP. Port 22 was specified in my original post and while troubleshooting, I opened all ports on the router.

Further, I can ping the server with no problem from the router itself.

I added your "iptables" suggestions, but nothing changed. Besides, I was able to SSH from inside the firewall, so it is not a question of the server not allowing it.

I am now thinking it is a problem with CentOS - or a problem communicating with my Mac Laptop.

0
 
LVL 7

Expert Comment

by:namol
ID: 21818560
So you setup a forward for port 22 to the centos machine? If you can hit it internally then there is something externally or between the outside and the server that is blocking the connection.
0
 

Author Comment

by:shambright
ID: 21818959
Right...

I will wait and see if anyone else has any suggestions for where to look.
0
 
LVL 7

Expert Comment

by:namol
ID: 21818988
can you hit any of the other servers from outside of the network?
0
 

Author Comment

by:shambright
ID: 21821526
Namol,

With all due respect, you keep asking questions and making comments that I answered in my posts.
I can remotely SSH to all of the other servers, just not the one I need.
0
 
LVL 14

Expert Comment

by:agriesser
ID: 21833333
Try to connect to port 22 on this machine without having SSH listening on this port.
To do this, SSH into this machine via another machine in this block (you said that this works for you already), stop the SSH server (the SSH session you're currently connected with won't quit when the server is down) and start nc (the TCP/IP swiss army knife) on this port by running the following command as root on this machine (you might need to install "nc", but usually it's installed on all common linux distributions by default):

nc -l -p 22

Now try to connect to port 22 from outside with telnet, e.g.:

telnet 123.234.232.132 22

and see if you can get a connection.
Try to type text into the telnet window and you should see this text appear on the terminal where you started nc.

If this works, you can at least be sure that the firewall/NAT/PAT rule is working properly.

After you've done this, you can quit nc with CTRL-C and don't forget to restart your SSH server, otherwise no future connection attempts can be made to this server.
0
 

Author Comment

by:shambright
ID: 21833857
Thanks for the reply.

Your command did not work as written.

Trying

nc -l -p 22 22

says 'Cannot use -p and -l'

I tried just

nc -l 22

...and this did not show any result with telnet from the remote site.
BUT I did try it from INSIDE the firewall, and it worked as you described.

I guess the problem is still at the firewall.

0
 
LVL 14

Expert Comment

by:agriesser
ID: 21833960
Out of my `man nc` (version 1.10-32 on Debian):

NC(1)                                                                    NC(1)

NAME
       nc - TCP/IP swiss army knife

SYNOPSIS
       nc [-options] hostname port[s] [ports] ...
       nc -l -p port [-options] [hostname] [port]

So either your netcat version is newer or older than mine, because mine supports -p and -l on one command line.

I just looked at the previous replies and saw namol suggesting:

iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT

Do you have iptables rules running on this host? If so, read on:

This won't work for outgoing connections, because new SSH sessions established from this host will not be generated at source port 22, neither will the replies to incoming ssh connections be initiated from source port 22.

If you have stateful filtering enabled in your iptables configuration, make sure to add the following iptables rule before all other rules:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

If you're limiting your machine in terms of outbound connections, make sure to add the related rule to the output chain too:

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

But personally, I wouldn't apply rules to the OUTPUT chain if there's no really good reason for it.

Could I see the output of `iptables -L -n -v` on the CentOS box that doesn't accept SSH connections?
0
 

Accepted Solution

by:
shambright earned 0 total points
ID: 21834047
Problem Solved.

I had an incorrect netmask (too narrow)  at:

/etc/sysconfig/network-scripts/ifcfg-eth0

even though the 'ifconfig' command showed the correct one.

Changing the file and rebooting brought everything online.

Annoying, but finished. Thanks for your suggestions.
0

Featured Post

[Live Webinar] The Cloud Skills Gap

As Cloud technologies come of age, business leaders grapple with the impact it has on their team's skills and the gap associated with the use of a cloud platform.

Join experts from 451 Research and Concerto Cloud Services on July 27th where we will examine fact and fiction.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Linux users are sometimes dumbfounded by the severe lack of documentation on a topic. Sometimes, the documentation is copious, but other times, you end up with some obscure "it varies depending on your distribution" over and over when searching for …
We all know how boring and exhausting it is to transfer huge web projects developed locally to a webserver simply via FTP. The File Transfer Protocol is a really nice solution if you need to transfer small amounts of files, but if you're plannin…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Suggested Courses

615 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question