Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Ubuntu 12.04 server with a hostnames 'example.org' and 'sub.domain.com', and some IP x.x.x.x, and with fail2ban installed.

On one client computer, I can SSH into my server at user@example.org, user@sub.domain.com, and user@x.x.x.x. On another client however, I cannot SSH into user@example.org.

Furthermore, upon digging into the server /var/log/ files, there are no logs for the second client attempting to log in via user@example.org. This is also evident in that fail2ban does not ban the second client upon multiple failed password attempts at user@example.org.

Running ssh -vvv user@example.org on the second client, the last debug message just says that the client is talking to the server - and then is denied.

Is there any way for me to further debug the issue on the server, or something that I'm missing?

Edit: I should also note that the hostname is resolving properly on all machines - ping, nslookup, and wget all appear to work correctly when attempting to resolve example.org.

share|improve this question

For easier debugging, set the LogLevel directive in /etc/ssh/sshd_config to Verbose or Debug (it's Info by default)

share|improve this answer

It's hard to tell what the real problem is because you are obfuscating the error messages. They are informative, familiar and less ambiguous than your renditions / interpretations. If you have error messages, provide them when requesting support.

The difference, I take it, lies in where these client machines are located relative to the server. I'm guessing one is inside, while the other is on the outside.

The error ' - and then is denied.' means that the server is not listening on that port. That is to say, the requested TCP port is not bound to a listening socket on the requested interface (IP address). Alternatively it means - client can not reach requested port on x.x.x.x due to a firewall.

You have to:

a. Allow connections originating from the external interface to reach TCP port 22

  • iptables -A INPUT -p tcp --dport ssh -j ACCEPT

b. Configure sshd to listen on all interfaces (default) or on the ip of the external interface.

  • ListenAddress x.x.x.x (/etc/sshd/sshd_config)

If the external interface of your sshd host has a different IP address than what example.org resolves to, thek you have a NAT.

c. Set up Masquerading (NAT) on your router.

INTERNAL_IP=10.3.0.7
INTERNAL_NM=255.255.255.224
INTERNAL=eth0
EXTERNAL=wlan0

ifconfig $INTERNAL $INTERNAL_IP netmask $INTERNAL_NM up

echo 1 >/proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o $EXTERNAL -s 10.3.0.0/24 -j MASQUERADE
iptables -A FORWARD -i $EXTERNAL -o $INTERNAL -m state \
                                   --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i $INTERNAL -o $EXTERNAL -j ACCEPT

# -m state is deprecated these days so you should probably figure out what the 
# new NAT method is

To get a proper answer, try updating your questions with:

  • real error messages
  • real addresses
  • is x x x x = 10.x.x.x or 192.x.x.x ?
  • is x.x.x.x the address of the interface where sshd is listening? (no need to disclose your full addresses, just hint at the subnets)
  • how do you obtain "properly resolved hostname"?
  • where are your clients (IP)?

ref: Ubuntu iptables

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .