ssh: acces denied (only from remote network)

From: Mitja (nun_at_example.com)
Date: 10/21/04


Date: Thu, 21 Oct 2004 13:43:34 +0200

Hi,
I can't get my sshd to work properly: it allows connections from the other computer in my home network, but says "ssh: connect to host <ip> port 22: Connection refused" when trying to connect from the outside.

Iptables are set to "policy accept" without any additional rules.

/etc/host.deny:
ALL:ALL
/etc/hosts.allow:
sshd:ALL

Sshd's configuration:
owl:/home/mitja# cat /etc/ssh/sshd_config | grep -v ^# | tr -s '\n'
Port 22
ListenAddress ::
ListenAddress 0.0.0.0
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 768
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 600
PermitRootLogin yes
StrictModes no
UseDNS no
RSAAuthentication yes
PubkeyAuthentication yes
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
PasswordAuthentication yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
KeepAlive yes
MaxStartups 3
Banner /etc/issue.net
Subsystem sftp /usr/lib/sftp-server
UsePAM yes

The server seems to be up and running:
owl:/home/mitja# ps aux | grep sshd
root 1691 0.0 0.7 3428 1468 ? Ss 12:32 0:00 /usr/sbin/sshd
root 1878 0.0 0.3 3244 7022 on ::.0 pts/0 R+ 13:11 0:00 grep sshd
owl:/home/mitja# netstat -ln | grep :22
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN

Running the daemon manually with debug info:
owl:/home/mitja# sshd -d
debug1: sshd version OpenSSH_3.8.1p1 Debian 1:3.8.1p1-8.sarge.1
owl:/home/mitja# debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.

I get the same response when trying port 22 with the telnet command:
owl:/home/mitja# telnet <ip> 22
Trying <ip>...
telnet: Unable to connect to remote host: Connection refused

Running the client:
owl:/home/mitja# ssh mitja@<ip> -v -v
OpenSSH_3.8.1p1 Debian 1:3.8.1p1-8.sarge.1, OpenSSL 0.9.7d 17 Mar 2004
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to <ip> [<ip>] port 22.
debug1: connect to address <ip> port 22: Connection refused
ssh: connect to host <ip> port 22: Connection refused

Everything works fine when connecting to server in question locally (or, as mentioned, from the other machine in the network):
mitja@owl:~$ ssh mitja@localhost
Password:
<etc.>

Home network consists of two computers and an ADSL modem, all connected via a switch. DSL provider gives me two external IPs, so there's no need for masquerade or any kind of proxying.

The server in question is a Debian, kerl version 2.6.3.

I'm stuck and can't think of anything; does anybody with more experience know where else to look?



Relevant Pages

  • Re: OPENSSH 3.4p1-3 on AIX 4.3.3
    ... Teh debug output from the server is exactly the same, ... >another port. ... >reverse dns setup properly for that client? ... >debug1: Server will not fork when running in debugging mode. ...
    (SSH)
  • Re: Server refusing connection.
    ... the command line through my PuTTY client, but I cannot load the URLs ... I need some assistance to figure out why my ssh server is refusing my ... debug1: read PEM private key done: type RSA ... Server listening on 0.0.0.0 port 22. ...
    (comp.security.ssh)
  • OpenSSH 3.5p1 port forwarding problem on Solaris 2.8
    ... I'm trying to use port forwarding to get a SqlNet connections back thru ... This gets a Connection refused. ... debug1: Rhosts Authentication disabled, ...
    (comp.security.ssh)
  • Re: Problems using gssapi authentication from FreeBSD to Linux machines
    ... More information as to why will be in the debug logs from the server. ... debug1: read PEM private key done: type RSA ... Server listening on:: port 2222. ...
    (SSH)
  • Re: OPENSSH 3.4p1-3 on AIX 4.3.3
    ... Teh debug output from the server is exactly the same, ... another port. ... reverse dns setup properly for that client? ... debug1: Server will not fork when running in debugging mode. ...
    (SSH)