Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #230622 > unrolled thread

Can't connect to workstation using ssh from a remote machine

Back to article view | Back to linux.debian.user

Contents

  Can't connect to workstation using ssh from a remote machine Gary Dale <gary@extremeground.com> - 2021-01-13 21:30 +0100
    Re: Can't connect to workstation using ssh from a remote machine Dan Ritter <dsr@randomstring.org> - 2021-01-13 21:50 +0100
      Re: Can't connect to workstation using ssh from a remote machine <tomas@tuxteam.de> - 2021-01-13 22:20 +0100
      Re: Can't connect to workstation using ssh from a remote machine Gary Dale <gary@extremeground.com> - 2021-01-14 02:10 +0100
        Re: Can't connect to workstation using ssh from a remote machine Dan Ritter <dsr@randomstring.org> - 2021-01-14 02:30 +0100
          Re: Can't connect to workstation using ssh from a remote machine Gary Dale <gary@extremeground.com> - 2021-01-14 03:00 +0100
          Re: Can't connect to workstation using ssh from a remote machine Greg Wooledge <wooledg@eeg.ccf.org> - 2021-01-14 14:00 +0100
            Re: Can't connect to workstation using ssh from a remote machine Gary Dale <gary@extremeground.com> - 2021-01-14 20:30 +0100
        Re: Can't connect to workstation using ssh from a remote machine Joe <joe@jretrading.com> - 2021-01-14 10:10 +0100
    Re: Can't connect to workstation using ssh from a remote machine Charles Curley <charlescurley@charlescurley.com> - 2021-01-14 01:30 +0100
      Re: Can't connect to workstation using ssh from a remote machine Gary Dale <gary@extremeground.com> - 2021-01-14 02:20 +0100

#230622 — Can't connect to workstation using ssh from a remote machine

I'm running Bullseye on an AMD64 system on my workstation and Buster on 
an AMD64 system on my server.

I'm trying to establish an ssh connection from my server to my 
workstation to facilitate a nightly pull backup of /home run by the 
server. However the ssh request times out.

I can connect via ssh to my workstation locally, just not from other 
machines *i.e. ssh <workstation> works when run on <workstation> but not 
when run on a different computer).

Debugging output isn't any help. It shows the connection being attempted 
then eventually timing out.

Any ideas pm what is going on? I've noted that Bullseye seems to have a 
problem with GnuTLS right now (for ftp operations). Could that be related?

[toc] | [next] | [standalone]

#230624

Gary Dale wrote: 
> I'm running Bullseye on an AMD64 system on my workstation and Buster on an
> AMD64 system on my server.
> 
> I'm trying to establish an ssh connection from my server to my workstation
> to facilitate a nightly pull backup of /home run by the server. However the
> ssh request times out.
> 
> I can connect via ssh to my workstation locally, just not from other
> machines *i.e. ssh <workstation> works when run on <workstation> but not
> when run on a different computer).
> 
> Debugging output isn't any help. It shows the connection being attempted
> then eventually timing out.

Assuming their names are workstation and server, give us the
output of the following. Use ctrl-c to cancel things as
necessary.

>From workstation:
$ ping -c3 server
$ telnet server 22

>From server:
$ ping -c3 workstation
$ telnet workstation 22

-dsr-

[toc] | [prev] | [next] | [standalone]

#230626

[Multipart message — attachments visible in raw view] — view raw

On Wed, Jan 13, 2021 at 03:48:34PM -0500, Dan Ritter wrote:
> Gary Dale wrote: 
> > I'm running Bullseye on an AMD64 system on my workstation and Buster on an
> > AMD64 system on my server.
> > 
> > I'm trying to establish an ssh connection from my server to my workstation
> > to facilitate a nightly pull backup of /home run by the server. However the
> > ssh request times out.
> > 
> > I can connect via ssh to my workstation locally, just not from other
> > machines *i.e. ssh <workstation> works when run on <workstation> but not
> > when run on a different computer).
> > 
> > Debugging output isn't any help. It shows the connection being attempted
> > then eventually timing out.
> 
> Assuming their names are workstation and server, give us the
> output of the following. Use ctrl-c to cancel things as
> necessary.
> 
> >From workstation:
> $ ping -c3 server
> $ telnet server 22
> 
> >From server:
> $ ping -c3 workstation
> $ telnet workstation 22

And "ssh -v workstation", please :)

Cheers
 - t

[toc] | [prev] | [next] | [standalone]

#230655

On 2021-01-13 15:48, Dan Ritter wrote:
> Gary Dale wrote:
>> I'm running Bullseye on an AMD64 system on my workstation and Buster on an
>> AMD64 system on my server.
>>
>> I'm trying to establish an ssh connection from my server to my workstation
>> to facilitate a nightly pull backup of /home run by the server. However the
>> ssh request times out.
>>
>> I can connect via ssh to my workstation locally, just not from other
>> machines *i.e. ssh <workstation> works when run on <workstation> but not
>> when run on a different computer).
>>
>> Debugging output isn't any help. It shows the connection being attempted
>> then eventually timing out.
> Assuming their names are workstation and server, give us the
> output of the following. Use ctrl-c to cancel things as
> necessary.
>
> >From workstation:
> $ ping -c3 server
> $ telnet server 22
>
> >From server:
> $ ping -c3 workstation
> $ telnet workstation 22
>
> -dsr-
>
I can get to the server from workstation using ssh. I just can't do it 
in the other direction. On server, I can ping workstation but:
$ telnet workstation  22
Trying 192.168.1.20...
telnet: Unable to connect to remote host: Connection timed out

Whereas the other way, I get a protocol mismatch error.

[toc] | [prev] | [next] | [standalone]

#230657

Gary Dale wrote: 
> On 2021-01-13 15:48, Dan Ritter wrote:
> > >From server:
> > $ ping -c3 workstation
> > $ telnet workstation 22
> > 
> > -dsr-
> > 
> I can get to the server from workstation using ssh. I just can't do it in
> the other direction. On server, I can ping workstation but:
> $ telnet workstation  22
> Trying 192.168.1.20...
> telnet: Unable to connect to remote host: Connection timed out

Options:

. workstation is not running sshd
    ps auwx|grep ssh

. workstation is not running sshd on port 22
    ss -tlnp|grep 22
    
. workstation's DNS is wrong/ that's not the right IP
. firewall or other packet filtering on one or the other or in
  between

-dsr-

[toc] | [prev] | [next] | [standalone]

#230659

On 2021-01-13 20:20, Dan Ritter wrote:
> Gary Dale wrote:
>> On 2021-01-13 15:48, Dan Ritter wrote:
>>> >From server:
>>> $ ping -c3 workstation
>>> $ telnet workstation 22
>>>
>>> -dsr-
>>>
>> I can get to the server from workstation using ssh. I just can't do it in
>> the other direction. On server, I can ping workstation but:
>> $ telnet workstation  22
>> Trying 192.168.1.20...
>> telnet: Unable to connect to remote host: Connection timed out
> Options:
>
> . workstation is not running sshd
>      ps auwx|grep ssh
It's running
>
> . workstation is not running sshd on port 22
>      ss -tlnp|grep 22
On port 22
>      
> . workstation's DNS is wrong/ that's not the right IP
> . firewall or other packet filtering on one or the other or in
>    between
>
> -dsr-
The name resolution is correct. Server has a static IP while Workstation 
has a DHCP reservation - just redid it a week ago after installing a new 
MB. There are are two network switches between them (the router that 
handles dhcp is plugged into one of the switches as well).

[toc] | [prev] | [next] | [standalone]

#230665

On Wed, Jan 13, 2021 at 08:20:30PM -0500, Dan Ritter wrote:
> Gary Dale wrote: 
> > $ telnet workstation  22
> > Trying 192.168.1.20...
> > telnet: Unable to connect to remote host: Connection timed out

> Options:
> . workstation is not running sshd

No.  That would give you "connection refused" immediately, not a timeout.

> . workstation is not running sshd on port 22

Same.

> . workstation's DNS is wrong/ that's not the right IP
> . firewall or other packet filtering on one or the other or in
>   between

Those two are possible.

In the *general* case (not here, because there's additional information
here), you also have:

 * Machine is powered off/crashed.
 * Machine's network cable is unplugged or loose.
 * A router is down/malfunctioning between you and the machine.
 * Machine's networking is mis-configured.

These are ruled out in this particular case because the OP is typing
other commands on the target machine, including commands that invoke
network connections in the opposite direction.

IMHO the most likely scenario here is "firewall".

The strongest indicator of a firewall being the cause of the problem is
that you can ping a given IP address (or telnet to port X on that
IP address), but you cannot telnet to port Y on that same IP address.

If the telnet failure is a timeout rather than a connection refused,
while other network connections to the same IP work, then it's 100%
a firewall issue.  Everything else (crashed service, etc.) would give
you a connction refused.

[toc] | [prev] | [next] | [standalone]

#230682

On 2021-01-14 07:55, Greg Wooledge wrote:
> On Wed, Jan 13, 2021 at 08:20:30PM -0500, Dan Ritter wrote:
>> Gary Dale wrote:
>>> $ telnet workstation  22
>>> Trying 192.168.1.20...
>>> telnet: Unable to connect to remote host: Connection timed out
>> Options:
>> . workstation is not running sshd
> No.  That would give you "connection refused" immediately, not a timeout.
>
>> . workstation is not running sshd on port 22
> Same.
>
>> . workstation's DNS is wrong/ that's not the right IP
>> . firewall or other packet filtering on one or the other or in
>>    between
> Those two are possible.
>
> In the *general* case (not here, because there's additional information
> here), you also have:
>
>   * Machine is powered off/crashed.
>   * Machine's network cable is unplugged or loose.
>   * A router is down/malfunctioning between you and the machine.
>   * Machine's networking is mis-configured.
>
> These are ruled out in this particular case because the OP is typing
> other commands on the target machine, including commands that invoke
> network connections in the opposite direction.
>
> IMHO the most likely scenario here is "firewall".
>
> The strongest indicator of a firewall being the cause of the problem is
> that you can ping a given IP address (or telnet to port X on that
> IP address), but you cannot telnet to port Y on that same IP address.
>
> If the telnet failure is a timeout rather than a connection refused,
> while other network connections to the same IP work, then it's 100%
> a firewall issue.  Everything else (crashed service, etc.) would give
> you a connction refused.


You are right. Somehow I found that ufw is running on my workstation. I 
don't remember adding it but it was blocking all access except for some 
ports in the 1700 range. Allowing ssh seems to have fixed the problem.

[toc] | [prev] | [next] | [standalone]

#230661

On Wed, 13 Jan 2021 20:07:54 -0500
Gary Dale <gary@extremeground.com> wrote:

 
> > Assuming their names are workstation and server, give us the
> > output of the following. Use ctrl-c to cancel things as
> > necessary.
> >  
> > >From workstation:  
> > $ ping -c3 server
> > $ telnet server 22
> >  
> > >From server:  
> > $ ping -c3 workstation
> > $ telnet workstation 22
> >
> > -dsr-
> >  
> I can get to the server from workstation using ssh. I just can't do
> it in the other direction. On server, I can ping workstation but:
> $ telnet workstation  22
> Trying 192.168.1.20...
> telnet: Unable to connect to remote host: Connection timed out
> 
> Whereas the other way, I get a protocol mismatch error.
> 

If a protocol works one way but not the other, routing is correct and it
will *always* be a firewall issue.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#230649

On Wed, 13 Jan 2021 15:27:07 -0500
Gary Dale <gary@extremeground.com> wrote:

> I can connect via ssh to my workstation locally, just not from other 
> machines *i.e. ssh <workstation> works when run on <workstation> but
> not when run on a different computer).

Firewall? Try "tail -f /var/log/syslog" on workstation while trying
from another machine.

-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [next] | [standalone]

#230656

On 2021-01-13 19:03, Charles Curley wrote:
> On Wed, 13 Jan 2021 15:27:07 -0500
> Gary Dale <gary@extremeground.com> wrote:
>
>> I can connect via ssh to my workstation locally, just not from other
>> machines *i.e. ssh <workstation> works when run on <workstation> but
>> not when run on a different computer).
> Firewall? Try "tail -f /var/log/syslog" on workstation while trying
> from another machine.
>
No errors showing up related to a connection attempt, although I do get 
a lot of auth errors on <server> from people trying to break in but 
failing to provide the propercertificate.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web