Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why can't I ssh using the hostname specified in my CNAME record? I can ssh in just fine when I use the hostname it points to. It's been more than 72 hours.

I've got a domain "mydomain.com", and it has a CNAME record for host "foo" that points to "ec2-xxx-yyy-zzz-aaa.compute-1.amazonaws.com". (I'm using EC2, obviously. Maybe it's relevant?) The CNAME record has been live for at least a week.

When I try

ssh -i my.key myuser@foo.mydomain.com

I get

ssh: connect to host foo.mydomain.com port 22: Operation timed out

but when I try

ssh -i my.key myuser@ec2-xxx-yyy-zzz-aaa.compute-1.amazonaws.com

I log in just fine.

Mind you, the behavior has changed. At first I was able to use foo.mydomain.com to ssh. But now I can't.

When I run nslookup on foo.mydomain.com, I get back:

foo.mydomain.com canonical name=ec2-xxx-yyy-zzz-aaa.compute-1.amazonaws.com.
Name: ec2-xxx-yyy-zzz-aaa.compute-1.amazonaws.com
Address: xxx.yyy.zzz.aaa

and nslookup ec2-xxx-yyy-zzz-aaa.compute-1.amazonaws.com:

Name: ec2-xxx-yyy-zzz-aaa.compute-1.amazonaws.com
Address: xxx.yyy.zzz.aaa

share|improve this question
5  
You appear to have obfuscated all the relevant information. It would be helpful to have the actual hostnames in question. – Michael Hampton Apr 25 '14 at 19:28
    
Operation timed out means ssh found an address - so that's working fine. Try pinging yor CNAME and seeing what IP it gives. Timed out means 'tried to get remote server but it didn't respond'. Which usually means firewalls or wrong IP address in the first place. – Sobrique Apr 25 '14 at 19:28
    
Use ssh -vv perhaps? Maybe some verbose output will give some more hints about the problem. Do you have anything in your local /etc/hosts file perhaps? Remember that nslookup explicitly uses DNS only, but your system name resolution may use other methods for resolving names. The -vv option should tell you what IP the ssh client resolved the name too. – Zoredache Apr 25 '14 at 21:46

Without knowing what the CNAME says, it's hard to be sure. However 'Connection Timed out' means that the ssh process could resolve the hostname, but whatever host it was talking to didn't respond. Typically that means firewalled or down.

The only scenario I can think of where this would apply is that either your CNAME is wrong, or your host isn't using DNS to resolve it - any chance foo.domain.com is in /etc/hosts, ldap or NIS?

Also: Try a ping and see what IP address it's pinging.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.