Here is my problem:

I want to log to my ubuntu server from a macbookpro (10.10.4) via ssh but it is not working from any public IP address

When I m on the same wifi than my server and that I try to connect to the private/local IP it is just working fine. It asks my password and I can login :

OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to XXX.XXX.X.XX [XXX.XXX.X.XX] port 22.
debug1: Connection established.
debug1: identity file /Users/XXXXX/.ssh/id_rsa type -1
debug1: identity file /Users/XXXXX/.ssh/id_rsa-cert type -1
debug1: identity file /Users/XXXXX/.ssh/id_dsa type -1
debug1: identity file /Users/XXXXX/.ssh/id_dsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 pat OpenSSH*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-sha1-etm@openssh.com none
debug1: kex: client->server aes128-ctr hmac-sha1-etm@openssh.com none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<2048<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA XX:XX:XX:XXX:XX:XX
debug1: Host 'XXX.XXX.X.XX' is known and matches the RSA host key.
debug1: Found key in /Users/XXXXX/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/XXXXX/.ssh/id_rsa
debug1: Trying private key: /Users/XXXXX/.ssh/id_dsa
debug1: Next authentication method: password
XXXXX@XXX.XXX.X.XX's password: 

But when I'm trying to connect from public IP I get this message:

OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to XX.XX.XXX.XX [XX.XX.XXX.XX] port 22.
debug1: connect to address XX.XX.XX.XX port 22: Connection refused
ssh: connect to host XX.XX.XX.XX port 22: Connection refused

Here is what I've done until now:

  1. Checked which port is listening ssh -> port 22

    tcp        0      0    *               LISTEN      5886/sshd  
  2. Checked if the firewall was active on the port 22 -> it is not

    sudo ufw verbose
    Status: inactive
  3. Tried to uninstall/reinstall openssh-server with apt-get -> didn't change a thing

  4. Screamed and punched the wall -> didn't change a thing

What can I do to fix this issue?

Is there a particular problem with connecting from a mac ?

I'm quite new to Linux so be gentle, please :)

  • 3
    Have you setup port forwarding on your router? – Robby1212 Feb 4 '18 at 21:36
  • 2
    How exactly is the SSH server connected to the internet? Which network components are between it and the internet access provider? – David Foerster Feb 4 '18 at 22:00

First off: Welcome!

What it looks like from the logs and the error message is that port forwarding is not enabled on your router to allow the connection to the machine via SSH.

This can be done by looking up your model of router and figuring out how to forward port 22 to the IP address of your server. You can determine the IP address of your server using ifconfig. While you are in your router settings you might as well setup a static IP address for the server as well so it doesn't move around.

The other IP address issue is if your ISP doesn't use dynamic IP then your IP address might change "randomly and without notice". This depends on your ISP, my ISP "uses" dynamic IP but it hasn't changed in the 8 months I've lived here.

You can set up a script to have the server email you your external IP address daily if you need access.

If you continue having a connection refused error, your ISP also might have blocked port 22 among a list of other ports for "security".

There is a giant caveat to this and by giant I mean a GIANT caveat. This process will leave your server vulnerable to attacks of any kind opening up that port. You will want to harden your server against such attacks to the best of your abilities. This can be done a number of ways and it is recommended to follow them all.

How to secure an Ubuntu 16.04 LTS server is a good in depth guide to securing your server.

Please make sure that you implement as many of them as possible. I highly recommend using key access, locking down to specific users and disabling root access among other things. If you don't ABSOLUTELY need access from an external IP, then I wouldn't bother.

  • 1
    Thanks a lot for your answer ! I'm going to try all that. Would it be more sure to run ssh through another port than the 22 ? – wikninja Feb 4 '18 at 22:08
  • 1
    Well that's a hotly argued topic, changing ports doesn't technically improve security. It improves obscurity which is a part of security so it can help, I would recommend implementing more solid techniques then trying to rely on obscurity to "protect" you. – Robby1212 Feb 4 '18 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.