0

Dev linux server was running no problem, then out of the blue could not ssh to it. Rebooted, still could not ssh.

Logged in as root using lish, but cant find any problems.

  • Sshd is running, and we can ssh to localhost from the server ok.

  • there is plenty of disk space

  • tried ssh from different countries.

  • tried ssh -v, did not show anything useful.

  • Ip has not changed, ifconfig looks correct (nothing has changed)

  • Can ping out to random servers from this server (e.g. 8.8.8.8) so networking is ok.

  • ufw status shows FW running with ssh allowed etc.

  • top shows no strange processes, and the server is using very little CPU.

  • can ssh into another linode server in the same DC.

  • No reported outages at linode.

  • i can remotely ping the server and traceroute without issue

  • I tried disabling the fw (ufw disable) temporarily, this did not help

  • There was big spike of CPU and transfer at around the time access to the servers stopped.

  • nothing in /etc/hosts.deny

  • telnet myserverip 22 also times out.

  • I can ping external servers, but I cant ssh from the problem server to any good servers. So I cant ssh in our out, but I can ssh xxx@localhost.

  • If i try "apt-get update" it fails to connect to any of the mirrors (error message is off the limited lish screen)

  • netstat -peanut | grep 22 gives:

    tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN

Where else can I look for the issue?

there has been no updates or changes between working and not working.

UPDATE 1

Rinzwind suggested seeing what files in /var/log change after trying to log in. The following 3 files are constantly changing:

ufw.log syslog kern.log

Looks like all 3 are getting the same messages:

Jul 19 13:05:17 buysky-test kernel: [ 3756.028907] [UFW BLOCK] IN=eth0 OUT= MAC= f2:3c:91:76:f0:d7:50:87:89:40:a1:c1:08:00 SRC=188.179.244.54 DST=172.104.x.x L EN=40 TOS=0x00 PREC=0x00 TTL=55 ID=64113 PROTO=TCP SPT=39220 DPT=6908 WINDOW=203 33 RES=0x00 SYN URGP=0

Looks like ufw is blocking a lot of access attempts. I searched for my (external) IP, but its not in this list.

  • 1st place to visit would be /var/log/ and see if any log gets updated after you try to connect. – Rinzwind Jul 19 '18 at 12:57
0

I found the answer. Linode had disabled most networking functionality because they think the server was hacked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.