Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a Ubuntu 12.04 server with a hostnames 'example.org' and 'sub.domain.com', and some IP x.x.x.x, and with fail2ban installed.

On one client computer, I can SSH into my server at user@example.org, user@sub.domain.com, and user@x.x.x.x. On another client however, I cannot SSH into user@example.org.

Furthermore, upon digging into the server /var/log/ files, there are no logs for the second client attempting to log in via user@example.org. This is also evident in that fail2ban does not ban the second client upon multiple failed password attempts at user@example.org.

Running ssh -vvv user@example.org on the second client, the last debug message just says that the client is talking to the server - and then is denied.

Is there any way for me to further debug the issue on the server, or something that I'm missing?

Edit: I should also note that the hostname is resolving properly on all machines - ping, nslookup, and wget all appear to work correctly when attempting to resolve example.org.

share|improve this question
add comment

2 Answers 2

For easier debugging, set the LogLevel directive in /etc/ssh/sshd_config to Verbose or Debug (it's Info by default)

share|improve this answer
add comment

It's hard to tell what the real problem is because you are obfuscating the error messages. They are informative, familiar and less ambiguous than your renditions / interpretations. If you have error messages, provide them when requesting support.

The difference, I take it, lies in where these client machines are located relative to the server. I'm guessing one is inside, while the other is on the outside.

The error ' - and then is denied.' means that the server is not listening on that port. That is to say, the requested TCP port is not bound to a listening socket on the requested interface (IP address). Alternatively it means - client can not reach requested port on x.x.x.x due to a firewall.

You have to:

a. Allow connections originating from the external interface to reach TCP port 22

  • iptables -A INPUT -p tcp --dport ssh -j ACCEPT

b. Configure sshd to listen on all interfaces (default) or on the ip of the external interface.

  • ListenAddress x.x.x.x (/etc/sshd/sshd_config)

If the external interface of your sshd host has a different IP address than what example.org resolves to, thek you have a NAT.

c. Set up Masquerading (NAT) on your router.

INTERNAL_IP=10.3.0.7
INTERNAL_NM=255.255.255.224
INTERNAL=eth0
EXTERNAL=wlan0

ifconfig $INTERNAL $INTERNAL_IP netmask $INTERNAL_NM up

echo 1 >/proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o $EXTERNAL -s 10.3.0.0/24 -j MASQUERADE
iptables -A FORWARD -i $EXTERNAL -o $INTERNAL -m state \
                                   --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i $INTERNAL -o $EXTERNAL -j ACCEPT

# -m state is deprecated these days so you should probably figure out what the 
# new NAT method is

To get a proper answer, try updating your questions with:

  • real error messages
  • real addresses
  • is x x x x = 10.x.x.x or 192.x.x.x ?
  • is x.x.x.x the address of the interface where sshd is listening? (no need to disclose your full addresses, just hint at the subnets)
  • how do you obtain "properly resolved hostname"?
  • where are your clients (IP)?

ref: Ubuntu iptables

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.