I am having an issue with SSH on my web server. I am trying to SSH into the server, which is on the same network as the computer I am connecting from. I get the error:
ssh_exchange_identification: read: Connection reset by peer
However, when I activate a proxy software that routes my traffic through an out-of-network source, I am able to connect perfectly fine. Here is my firewall config:
# Generated by iptables-save v1.4.18 on Tue Dec 31 15:25:01 2013
*filter
:INPUT DROP [416:67311]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [11183:3738813]
:INBOUND - [0:0]
:LOG_FILTER - [0:0]
:LSI - [0:0]
:LSO - [0:0]
:OUTBOUND - [0:0]
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 21 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 20 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
COMMIT
# Completed on Tue Dec 31 15:25:01 2013
# Generated by iptables-save v1.4.18 on Tue Dec 31 15:25:01 2013
*mangle
:PREROUTING ACCEPT [10663:6982022]
:INPUT ACCEPT [10636:6980454]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [11183:3738813]
:POSTROUTING ACCEPT [11192:3739401]
COMMIT
# Completed on Tue Dec 31 15:25:01 2013
# Generated by iptables-save v1.4.18 on Tue Dec 31 15:25:01 2013
*nat
:PREROUTING ACCEPT [510:72807]
:INPUT ACCEPT [76:4516]
:OUTPUT ACCEPT [1160:71212]
:POSTROUTING ACCEPT [1160:71212]
COMMIT
# Completed on Tue Dec 31 15:25:01 2013
ssh -v user@server
Anthonys-MBP-3:~ acagliano$ ssh [email protected] -v
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /Users/acagliano/.ssh/config
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: /etc/ssh_config line 102: Applying options for *
debug1: Connecting to a.rockinwebs.tk [108.6.142.81] port 22.
debug1: Connection established.
debug1: identity file /Users/acagliano/.ssh/id_rsa type 1
debug1: identity file /Users/acagliano/.ssh/id_rsa-cert type -1
debug1: identity file /Users/acagliano/.ssh/id_dsa type -1
debug1: identity file /Users/acagliano/.ssh/id_dsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
ssh_exchange_identification: read: Connection reset by peer
/var/log/auth.log
Dec 4 00:57:06 acagliano-Satellite-C55-A sshd[23894]: Invalid user admin from 95.110.203.71
Dec 4 00:57:06 acagliano-Satellite-C55-A sshd[23894]: input_userauth_request: invalid user admin [preauth]
Dec 4 00:57:06 acagliano-Satellite-C55-A sshd[23894]: error: Could not get shadow information for NOUSER
Dec 4 00:57:06 acagliano-Satellite-C55-A sshd[23894]: Failed password for invalid user admin from 95.110.203.71 port 44174 ssh2
If I'm reading the logs correctly, was that an intrusion attempt? SSH isn't even running on that port..
Can anyone advise me?
eth0
? Also, do you have/etc/hosts.allow
and/etc/hosts.deny
?ssh -vvv
to connect and give us the output, that'll give more verbose messages.ssh -v
output you posted. So yeah, those logs are someone trying to login as admin. But to further troubleshoot your problem, connect to your web server usingssh [email protected] -vvv
, and if you can somehow get another connection to it while trying to do this, do atail -f /var/log/auth.log
on the server so you can see what's happening as you're trying to connect. If you can't, then just inspect the last few lines inauth.log
after your SSH connection doesn't go through. EDIT: alright, I guess it is fixed =). Post an answer.