[solved] SSH rejecting all requests except localhost

matejd11 · 2015-10-05 09:57:18

EDIT:
they are blocking all ports except 80 and 433.
/EDIT

I am able to connect from localhost, but from internet I got: Connection timed out.

My config is

#	$OpenBSD: sshd_config,v 1.97 2015/08/06 14:53:21 deraadt Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Port 22
AddressFamily any
ListenAddress x.x.x.x
#ListenAddress 0.0.0.0
#ListenAddress ::

# The default requires explicit activation of protocol 1
#Protocol 2

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 1h
ServerKeyBits 1024

# Ciphers and keying
#RekeyLimit default none

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin no 
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#RSAAuthentication yes
#PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile	.ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication yes
PermitEmptyPasswords no

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
#PrintMotd no # pam does that
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
UsePrivilegeSeparation sandbox		# Default for new installations.
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# override default of no subsystems
Subsystem	sftp	/usr/lib/ssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#	X11Forwarding no
#	AllowTcpForwarding no
#	PermitTTY no
#	ForceCommand cvs server

Match Address x.x.0.0/16
	AllowUsers matej

Last edited by matejd11 (2016-07-30 09:43:20)

Trilby · 2015-10-05 10:56:57

Connection timed out suggests this has nothing do do with your ssh configuration. Are both computers online? Can you ping the intended host from the client? Is either system behind a firewall (e.g., at a university or any employer with their own network and IT staff).

respiranto · 2015-10-05 10:57:23

ListenAddress x.x.x.x

Do these x's represent local IP's?
Are you sure you need this setting at all?

However, if you get a timeout, you simply cannot reach your server on the specified port.

Is the machine behind a router?
- Which does not forward the port 22?

And what is the purpose of this?

Match Address x.x.0.0/16
	AllowUsers matej

It limits everybody from x.x.0.0/16 to login as matej, while from any other location, one may login as anybody.

You should also consider restricting authentication with plain passwords, i.e. only allow public key authentication.

Last edited by respiranto (2015-10-05 10:57:46)

matejd11 · 2015-10-05 16:00:55

I have public IP, from my university, and x.x.0.0/16 is university subnet.

we have disabled ping requests, when I start web server at port 80 and enable forwarding port it works but when I enable port 22, and nothing happens.

Trilby · 2015-10-05 17:38:22

University firewalls are always a PITA in my experience - they frequently block incoming ssh traffic on port 22. They'll also almost certainly block any non-commonly used ports, so changing the port number would be fruitless.

You'll either need to request port 22 be opened by your IT department, or you may be out of luck.

respiranto · 2015-10-05 22:02:18

Trilby wrote:

They'll also almost certainly block any non-commonly used ports, so changing the port number would be fruitless.

Is it problematic to 'misuse' a commonly used port for another purpose than it is thought for?
E.g. 443 (HTTPS)?

Last edited by respiranto (2015-10-05 22:03:07)

basica · 2015-10-05 22:59:35

respiranto wrote:

Trilby wrote:
They'll also almost certainly block any non-commonly used ports, so changing the port number would be fruitless.
Is it problematic to 'misuse' a commonly used port for another purpose than it is thought for?
E.g. 443 (HTTPS)?

Some cases it's a good idea, like with SSH for example. While security through obscurity shouldn't be one's main method, that along with other methods does help a lot.

Trilby · 2015-10-05 23:23:53

respiranto wrote:

Is it problematic to 'misuse' a commonly used port for another purpose than it is thought for?

I have no idea about this particular case. It is not uncommon to use a nonstandard port for ssh - but as far as I know, one would generally use a not-assigned, or at least not commonly used port. This would be fine. But using a port that is essentially universally used for a different specific purpose might bring in a whole new set of issues.

In this case, if the OPs IP address is visible from the outside world (not always a safe assumption) and if the OP is not also using a web server (which they are currently) then this *might* work. Perhaps someone more well versed in networking could chime in. I barely know what I am doing and have only learned a bit through a little trial and a lot of error.

Keep in mind that circumventing a university firewall to put ssh over a http port could violate rules and have consequences. I'd advise against it entirely.

EDIT: I hate the phrase "Security through obscurity" as it is misleading and polarizing. Blinds on my windows might help keep my valuables inside safer as they thwart the prying eyes of the casual passer-by which can reduce temptation to attempt to break in. So blinds can be a good idea - but they are most definitely not "security" devices as they would do absolutely nothing to slow the progress of someone who wanted to break in. Using obscure ports for ssh may be a similarly prudent idea to reduce exposure to casual passers-by but it too is also most definitely not a security measure.

So I prefer "security through obsenity": tell all the m**** f**** in your neighborhood to stay away from your s***.

Arch Linux

#1 2015-10-05 09:57:18

[solved] SSH rejecting all requests except localhost

#2 2015-10-05 10:56:57

Re: [solved] SSH rejecting all requests except localhost

#3 2015-10-05 10:57:23

Re: [solved] SSH rejecting all requests except localhost

#4 2015-10-05 16:00:55

Re: [solved] SSH rejecting all requests except localhost

#5 2015-10-05 17:38:22

Re: [solved] SSH rejecting all requests except localhost

#6 2015-10-05 22:02:18

Re: [solved] SSH rejecting all requests except localhost

#7 2015-10-05 22:59:35

Re: [solved] SSH rejecting all requests except localhost

#8 2015-10-05 23:23:53

Re: [solved] SSH rejecting all requests except localhost

Board footer