3

I am using VirtualBox on Windows 10 (host) to create two virtual machines (Guest DT and Guest S). Can I SSH from Guest DT to the Guest S?

I am inexperienced with SSH. I have googled and read answers to the 'similar questions' on this site.

Error

On Guest DT, I do this:

$ ssh [email protected]
ssh: connect to host 10.0.2.15 port 22: Connection refused

Note:

  • I can successfully ping 10.0.2.15
  • test is my username on the Guest S.

Environment Setup

On Guest DT:

$ ssh-keygen
$ cat ~/.ssh/id_rsa.pub
ssh-rsa <a very long key> neil@neil-VirtualBox

On Guest S:

$ mkdir ~/.ssh
$ chmod 700 ~/.ssh
$ touch ~/.ssh/authorized_keys
$ chmod 600 ~/.ssh/authorized_keys
$ echo "ssh-rsa <a very long key> neil@neil-VirtualBox" > ~/.ssh/authorized_keys
$ /etc/init.d/ssh restart

On Guest S:

test@server01:~$ service sshd status

ssh.service - OpenBSD Secure Shell server
   Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2018-06-15 02:05:04 UTC; 1h 16min ago
  Process: 903 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)
 Main PID: 906 (sshd)
    Tasks: 1 (limit: 2317)
   CGroup: /system.slice/ssh.service
           └─906 /usr/sbin/sshd -D

Jun 15 02:05:04 server01 systemd[1]: Starting OpenBSD Secure Shell server...
Jun 15 02:05:04 server01 sshd[906]: Server listening on 0.0.0.0 port 22.
Jun 15 02:05:04 server01 sshd[906]: Server listening on :: port 22.
Jun 15 02:05:04 server01 systemd[1]: Started OpenBSD Secure Shell server.


$ sudo ufw status
[sudo] password for test: 
Status: inactive


/etc/ssh/sshd_config  contains :
#PubkeyAuthentication yes
5
  • Please run sudo ufw status, and edit your question to add the output from that command.
    – vidarlo
    Jun 15, 2018 at 4:50
  • make sure PubkeyAuthentication is set to yes in /etc/ssh/sshd_config
    – pLumo
    Jun 15, 2018 at 9:12
  • Are the VM's networks configured as "NAT" or "NAT Network"? Jun 15, 2018 at 14:53
  • Um, #PubkeyAuthentication yes is commented out, you need to remove the hash. I'd have tested with a simple password first. Presumably the ssh traffic passes through the host and could be blocked by its firewall?
    – pbhj
    Jun 15, 2018 at 21:59
  • I have now left PubkeyAuthentication yes uncommented. I had previously left it as a comment, because I read this in the top of the file : # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options override the # default value. I had therefore thought (perhaps wrongly) that PubkeyAuthentication yes was the default.
    – Neil E
    Jun 15, 2018 at 23:37

2 Answers 2

1

I think the default networking setup for VirtualBox guest is NAT and is not really intended to achieve this type of networking communication; but based on old posts may be possible by forwarding a non-system port to a Guest port and using the default loopback IP address to reach the Guest. 10.0.2.2 is default loopback.

Setup Networking

However, the easiest is to ensure you choose the correct networking for each of the Guests. Shutdown you guest machines, then in VirtualBox edit the Networking mode appropriate for your needs (note grid).

Virtualbox steps to change networking

Using Default NAT Network

Using NAT, VirtualBox uses a special IP 10.0.2.2 as a loopback (at least I think this is still true). Therefore ports forwarded from loopback are available to all guests. I think you should be able to take advantage of this. To communicate using a NAT network, will require one of the following:

  • Using VBoxManage, setup NAT Forwarding of a non-system port (1024–65535) to a lower system port (< 1024).

    1. In this case forward something like port 2222, to port 22 (default for SSH). This also assumes we'll use Guest S IP address of 10.0.2.15, per the question.
    2. Configure port forwarding on the Virtualbox Host, run:

      VBoxManage modifyvm "VM name" --natpf1 "guestssh,tcp,,2222,,22"

      All TCP traffic arriving on port 2222 on any host interface will be forwarded to port 22 in the guest. The protocol name tcp is a mandatory attribute defining which protocol should be used for forwarding (udp could also be used). The name guestssh is purely descriptive and will be auto-generated if omitted. The number after --natpf denotes the network card, like in other parts of VBoxManage.

    3. Check the added rule:

      VBoxManage showvminfo myserver | grep 'Rule'

    4. Connect to Guest Server via host loopback mapping and port-forwarding for Guest S

      neil@neil-VirtualBox$ ssh -p 2222 [email protected]

  • Alternative: change (Guest S) /etc/sshd_config to listen on a non-system port (> 1024). Then reload ssh.

4
  • How do I love thee? Let me count the ways
    – Neil E
    Jun 16, 2018 at 4:24
  • This formatting is driving me nuts. My previous comment is taken straight out of the help on how to make a line break and it isn't working for me. I have 2 spaces after 'How do I love thee? ' but 'Let me count the ways' is not on a new line.
    – Neil E
    Jun 16, 2018 at 4:26
  • Thanks Mike. My SSH is working. I have one concern. At one point in the process I got this message : The authenticity of host '[10.0.2.2]:2222 ([10.0.2.2]:2222)' can't be established. ECDSA key fingerprint is SHA256:kG7aJHOmo+ej8JF8L7iQ924NngwZv84ndtvCsEdBP/M. Are you sure you want to continue connecting (yes/no)? I answered 'yes' and continued, but I suspect I should really have answered 'no', then tried to resolve the issue. I will post what I did in a further comment. It made this comment too long to post.
    – Neil E
    Jun 16, 2018 at 4:33
  • When in doubt... esp when it comes to connecting to other servers (ssh/http/https/etc) search for an answer. Finding info has never been easier. But you might consider reading: stackoverflow.com/a/3664010 .... that said... and generally speaking connecting to resources on your own local network is pretty darn safe. Jul 25, 2018 at 21:28
0

Simply remove all ECDSA fingerprint keys (probably SHA256) contained within known-hosts directory.

  1. Run vi ~/.ssh/known_hosts
  2. Delete all keys associated with subject IP-address within the known_hosts file.
  3. Enter "Esc"-key then "Shift"-key + ":" + "x"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .