0

I am trying to connect to machine2, which is running Ubuntu 19.10, with machine1, running Ubuntu 18.04.5 using ssh. When I attempt to use the ip address of machine2 to connect from machine1 I get the following message:

[machine1_username]@[machine1_host]:~$ ssh -v [machine2_username]@ip_address
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /home/[home_directory]/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to [ip_address] [[ip_address]] port 22.
debug1: connect to address [ip_address] port 22: Connection timed out
ssh: connect to host [ip_address]port 22: Connection timed out

When I attempt to connect to machine2 from machine1 using the hostname I get the following message:

ssh: could not resolve hostname [hostname].local: Name or service not known

Neither command prompts me for a password. The public key has been stored in the authorized_keys file in .ssh directory on machine2 manually but as I said, I don't get that far.

My ufw settings on machine1 and machine2 allow traffic on that port, ssh has been installed on both machines, openssh-client has been installed on machine1 and openssh-server has been installed on machine2. The nmap command on both machines indicates port 22/tcp is open for ssh connections. I've also verified that machine2 is listening on Port 22.

sshd_config on the server:

#   $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Port 22
#AddressFamily any
#ListenAddress
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
LogLevel VERBOSE

# Authentication:

#LoginGraceTime 2m
PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.
AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem   sftp    /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#   X11Forwarding no
#   AllowTcpForwarding no
#   PermitTTY no
#   ForceCommand cvs server

ssh_config on the client:


# This is the ssh client system-wide configuration file.  See
# ssh_config(5) for more information.  This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.

# Configuration data is parsed as follows:
#  1. command line options
#  2. user-specific file
#  3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.

# Site-wide defaults for some commonly used options.  For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.

Host *
#   ForwardAgent no
#   ForwardX11 no
#   ForwardX11Trusted yes
   PasswordAuthentication yes
#   HostbasedAuthentication no
#   GSSAPIAuthentication no
#   GSSAPIDelegateCredentials no
#   GSSAPIKeyExchange no
#   GSSAPITrustDNS no
#   BatchMode no
#   CheckHostIP yes
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   IdentityFile ~/.ssh/id_ecdsa
#   IdentityFile ~/.ssh/id_ed25519
   Port 22
#   Protocol 2
#   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
#   MACs hmac-md5,hmac-sha1,[email protected]
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
#   PermitLocalCommand no
#   VisualHostKey no
#   ProxyCommand ssh -q -W %h:%p gateway.example.com
#   RekeyLimit 1G 1h
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication yes

From the client, machine1:

[machine1_username]@[machine1_host]:~$ sudo ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere                  
[ 2] 22/tcp (v6)                ALLOW IN    Anywhere (v6)

From the server, machine2:

[machine2_username@[machine2_host]:~$ sudo ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere                  
[ 2] 22/tcp (v6)                ALLOW IN    Anywhere (v6)

I've made sure I'm using the correct IP address and user name. Considering they are on the same network, I know I'm doing something dumb.

4
  • Have you started SSH daemon on the destination machine? Show an exact command you're using to connect. Sep 29, 2020 at 14:27
  • The ssh daemon starts on the local machine just fine.
    – user138669
    Sep 29, 2020 at 14:34
  • Can the machines ping each other?
    – FelixJN
    Sep 29, 2020 at 14:37
  • machine1 cannot ping machine2. It works the other way around, which doesn't help me.
    – user138669
    Sep 29, 2020 at 15:09

2 Answers 2

1

It has nothing to do with authentication. It looks a fw issue. Please check sudo dmesg for the connection drops ...

1
  • I checked but I'm not sure what to look for a quick google search did not indicate what flag I should be looking. Any suggestions?
    – user138669
    Sep 29, 2020 at 14:59
1

Consider your first attempt

When I attempt to use the ip address of machine2 to connect from machine1 I get the following message:

ssh: connect to host [ip_addr] port 22: Connection Timed out

This means that machine1 was able to route to ip_addr and attempt the connection. However, machine2 has a firewall configured to DROP all inbound connection attempts. You need to relax that to allow the connection attempt.

There is a difference between the error message generated when trying to connect to a client where sshd is not listening (or the firewall is set to REJECT incoming connections) and one where the host does not exist (or the firewall is set to DROP incoming connections)

ssh: connect to host […] port 22: Connection refused      # Host not listening, or REJECT
ssh: connect to host […] port 22: Connection timed out    # No host, or DROP

Now consider the second attempt

When I attempt to connect to machine2 from machine1 using the hostname I get the following message:

ssh: could not resolve hostname [hostname].local: Name or service not known

This is telling you that machine1 could not resolve the name hostname (did you mean machine2?) to an address, so it didn't know where to try and connect. Enable Bonjour/Avahi on machine2 so that it can advertise its address to machine1.

14
  • I think you mean machine1 could resolve the hostname. That is the machine I attempt to connect from. I think you have the machines mixed? Or am I confused?
    – user138669
    Sep 29, 2020 at 14:45
  • ufw settings state that communication on port 22 is allowed on both machines.
    – user138669
    Sep 29, 2020 at 14:48
  • @user138669 please see the explanation in my answer Sep 29, 2020 at 14:55
  • I turned the firewall off and got the same message.
    – user138669
    Sep 29, 2020 at 14:57
  • Is machine1 blocking outbound connections? Sep 29, 2020 at 14:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .