Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a DHCP server setup and I can't seem to connect to anything through SSH.

When I'm logged in to the server itself, I can SSH. But when I connect any machine to the DHCP server, that machine can SSH but every server I SSH to asks for a password when the normal behavior (when not connected to the DHCP server) does not.

Here are the contents of my iptables script that are related to port 22.

$IPT -t nat -A PREROUTING -i $LAN -p tcp --dport 22 -j REDIRECT --to-port 22
$IPT -A FORWARD -i $LAN -p tcp --dport 22 -j ACCEPT
$IPT -A INPUT -i $LAN -p tcp --dport 22 -j ACCEPT
$IPT -A INPUT -i $WAN -p tcp --dport 22 -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
$IPT -A INPUT -i $LAN -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

Am I missing something?

share|improve this question

closed as not a real question by John Gardeniers, Michael Hampton, Chris S Nov 28 '12 at 5:15

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

You can connect to the sshd, else it would not ask for a password. Thus the problem is not in your firewall rules. – Hennes Nov 23 '12 at 7:01
How come it asks for a password? I'm using an identity file and it doesn't ask for a password when I'm not connected to the DHCP server. Also, I get the WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! message whenever I switch from non-dhcp to dhcp and vice-versa. Really appreciate your help! :) – sfault Nov 23 '12 at 7:06
What is the full error text? e.g. "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is aa:bb:cc:dd:ee: Add correct host key in /root/.ssh/known_hosts to get rid of this message. Offending RSA key in /root/.ssh/known_hosts:8 RSA host key for has changed and you have requested strict checking" – Hennes Nov 23 '12 at 7:13
Yup, that's the one. – sfault Nov 23 '12 at 7:14

The reason this happens is because the server's IP address has changed, and your ssh client is checking the keys it has for another server that used to have that IP address.

The correct way of handling this, is to configure your DHCP to always give the same IP address to the same machine, by means of binding it with the machine's MAC address.

But if you want to keep the same setup, and use ssh anyway, then you'll need to purge the stored keys for the machine you're attempting to connect to by issuing:

ssh-keygen -R machine_host_name

replacing machine_host_name with what's appropriate, and then attempting to ssh.

share|improve this answer
The machine I'm trying to SSH to is in the cloud so there's no issue there. The issue is with my DHCP server. I can't SSH to my instances on the cloud when I'm connected to my DHCP server. If I connect directly to the modem, I can SSH to the same instance without any problems. – sfault Nov 28 '12 at 4:00
up vote -2 down vote accepted

Got it.

I removed everything related to SSH/port 22.

I added the following lines, instead:

$IPT -A INPUT -i $LAN -p tcp --destination-port 22 -m state --state NEW -j ACCEPT
$IPT -A OUTPUT -o $LAN -p tcp --destination-port 22 -m state --state NEW -j ACCEPT
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.