Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

OK, so this just started last week -

Whenever we try to connect to our server via ssh (we use sftp, as well) - The connection times out.

However, when you ssh to any other server and then ssh into the machine - it works flawlessly.

Now, the mindblowing thing is that sometimes the ssh connection will succeed.

Moments ago, I tried it from another machine, and then my own, and it worked - only to time out the next go around.

Last week, simply restarting the ssh daemon worked, but this week, no such luck. I even went in and changed:

/etc/hosts.allow 

ALL : ALL

and

/etc/hosts.deny 

is blank.

The firewall config hasn't changed - but I even disabled the firewall to see if that would work - It did, for a moment - before cutting off, again. (ufw is set to "ALLOW" not "LIMIT")

When I try SSH'ing in from my phone -- it works, fine --

So, it seems the problem is with our ISP/router/gateway - However, I see no log in the router/gateway that says its blocking our connections -

And that wouldn't explain why we can SSH into any other server -- except for this one - from our network ---

I truly appreciate any insight that anyone may have on this matter -

share|improve this question
2  
Are you using fail2ban on your server by any chance? I've seen this behaviour on boxes where fail2ban was running and where too many incorrect login attempts where being made, causing fail2ban to block the IP. –  Teun Vink Nov 11 '13 at 15:11
    
I'll check, but the strange thing is that it doesn't consistently block the IP - we can get in, sometimes - Is that the sort of behavior fail2ban creates? I uninstalled it, and it seems to be working, now -- But the funny thing is, I was able to log in via the IP in question - –  rm-vanda Nov 11 '13 at 15:22
1  
Yes, fail2ban blocks an IP for a specific amount of time after too many login failures. After that time, the IP is unblocked. –  Teun Vink Nov 11 '13 at 15:29
    
Well, that's strange, since we're using SSH-keys - Everything works flawlessly, now, though - so if that solution continues to work, I'll accept that as the right answer - –  rm-vanda Nov 11 '13 at 15:47
    
Do other services work while SSH is timing out? For example, can you still ping the server OK? –  jlehtinen Nov 11 '13 at 15:49

2 Answers 2

up vote 2 down vote accepted

One cause of this behaviour I know of is fail2ban. This program blocks SSH access when too many bad logins are seen within a specific timeframe. This can be both password logins and key based logins. After a specified time the IP address is unblocked again.

Check your server if fail2ban is installed and if is check your logs for blacklisting actions. If fail2ban is blocking your host every now and thn, you should be able to check in your auth logs which user/key is causing these problems. fail2ban supports IP whitelisting, so you can prevent trusted IP's from ever being blacklisted.

share|improve this answer

I've had this happen when DNS resolves intermittently or slowly.

Check that you have a valid nameserver in your /etc/resolv.conf on the server side, and that an nslookup or dig on your client IP resolves a name without timing out.

You may even test by adding an entry to /etc/hosts for the IP and hostname for the machine you are connecting from, in the servers hosts file.

share|improve this answer
    
This is also a good answer - and I was beginning to suspect it might some DNS issue, since it turned out that we were using IP's for all of the servers we were using to SSH into the server in question-- However, adding our IP to fail2ban's whitelist seems to have solved the problem flawlessly. Thank you for your input, though! –  rm-vanda Nov 12 '13 at 15:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.