Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A friend approached me about what appeared initially to be a Wordpress issue on a blog hosted on a Linux box; Wordpress was not upgrading XYZ at first attempt. I tried to get some diagnostics and maybe manually update Wordpress, only to find that trying to use putty to ssh in as root@[deleted].com was rejected. I logged into an unrelated NetBSD box and tried to ssh in, and got:

haywardfamily ~ {501}: ssh root@[deleted].com
ssh_exchange_identification: Connection closed by remote host

After a couple of tries from this computer, he went over to another machine to confirm behavior and got blocked two times, then logged in successfully on the third time. Furthermore, I saw him use an sftp client to successfully connect and interact with the server.

Has the box been rooted? I'm not sure what can be done if we can't connect, but if we do succeed in getting an ssh connection as root, what can/should be done to restore regular access?

What are next diagnostic / repair steps from here?

Thanks,

share|improve this question
    
The next diagnostic step would be a more verbose ssh output. This will give a clue about what is happening in the background. ssh -vv user@host will be a good start. Then we can take it from there later :-) –  user894627 Apr 5 at 18:29

1 Answer 1

It is generally considered good practice to disable root logins. Users should login with their own account, then use sudo.

It is a very common attack vector to try to break root's password and therefore getting privileged access to your box. Your friend's box maybe configured to disable an account for a period of time if there has been too many failed attempts to login.

share|improve this answer
    
Thank you; I added an unprivileged user and that user has had similarly flaky results to trying to log in. Any reason why paul@[deleted].com would not be allowed in? –  Jonathan Hayward Apr 5 at 17:59
    
That does make it a bit more interesting! ;) What does your auth logs say? Other logs? Is your latency fluctuating, or is it stable? Are you suffering any pack loss? Once you have established a connection, can you ssh to the local box without any problems? Try ssh'ing to the ip addresses vs the dns hostname. –  David Apr 5 at 18:04
    
How about other services, eg http? Are they working normally? –  David Apr 5 at 18:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.