Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Why can't I ssh using the hostname specified in my CNAME record? I can ssh in just fine when I use the hostname it points to. It's been more than 72 hours.

I've got a domain "mydomain.com", and it has a CNAME record for host "foo" that points to "ec2-xxx-yyy-zzz-aaa.compute-1.amazonaws.com". (I'm using EC2, obviously. Maybe it's relevant?) The CNAME record has been live for at least a week.

When I try

ssh -i my.key myuser@foo.mydomain.com

I get

ssh: connect to host foo.mydomain.com port 22: Operation timed out

but when I try

ssh -i my.key myuser@ec2-xxx-yyy-zzz-aaa.compute-1.amazonaws.com

I log in just fine.

Mind you, the behavior has changed. At first I was able to use foo.mydomain.com to ssh. But now I can't.

When I run nslookup on foo.mydomain.com, I get back:

foo.mydomain.com canonical name=ec2-xxx-yyy-zzz-aaa.compute-1.amazonaws.com.
Name: ec2-xxx-yyy-zzz-aaa.compute-1.amazonaws.com
Address: xxx.yyy.zzz.aaa

and nslookup ec2-xxx-yyy-zzz-aaa.compute-1.amazonaws.com:

Name: ec2-xxx-yyy-zzz-aaa.compute-1.amazonaws.com
Address: xxx.yyy.zzz.aaa

share|improve this question
5  
You appear to have obfuscated all the relevant information. It would be helpful to have the actual hostnames in question. –  Michael Hampton Apr 25 at 19:28
    
Operation timed out means ssh found an address - so that's working fine. Try pinging yor CNAME and seeing what IP it gives. Timed out means 'tried to get remote server but it didn't respond'. Which usually means firewalls or wrong IP address in the first place. –  Sobrique Apr 25 at 19:28
    
Use ssh -vv perhaps? Maybe some verbose output will give some more hints about the problem. Do you have anything in your local /etc/hosts file perhaps? Remember that nslookup explicitly uses DNS only, but your system name resolution may use other methods for resolving names. The -vv option should tell you what IP the ssh client resolved the name too. –  Zoredache Apr 25 at 21:46

2 Answers 2

Without knowing what the CNAME says, it's hard to be sure. However 'Connection Timed out' means that the ssh process could resolve the hostname, but whatever host it was talking to didn't respond. Typically that means firewalled or down.

The only scenario I can think of where this would apply is that either your CNAME is wrong, or your host isn't using DNS to resolve it - any chance foo.domain.com is in /etc/hosts, ldap or NIS?

Also: Try a ping and see what IP address it's pinging.

share|improve this answer

A CNAME (Alias) record points to an A (Host) record. You can create multiple CNAME records and point them to an A record. The most common CNAME records are the subdomains www and ftp.

CNAME records make your DNS data easier to manage. If you change the IP address of an A record, all CNAME records pointed to that A record automatically follow the new IP address. The alternative solution, multiple A records, is not as simple as using CNAME records.

source

Your CNAME needs to point to an A record, not the reverse DNS name of your host.

share|improve this answer
    
It's not actually accurate to say that a CNAME points to an A record. The CNAME actually makes its name an alias for the other (canonical) name regardless of requested type (nothing specific to A and/or AAAA). I would not consider it good practice to use CNAME in cases where it doesn't serve a purpose (there is not really any reason why you should publish your indirections and let the recipient work those out over and over again, just improve your management process instead). Also, the name in the question looks like something that would likely have an A record. –  Håkan Lindqvist Apr 25 at 19:49
    
@HåkanLindqvist How is that not correct? A CNAME's target is an A record, yes? –  Creek Apr 25 at 20:03
    
No, as I explained, a CNAME record makes one name an alias for another. Again, just the names, it has nothing to do with any specific record type. If you add a CNAME record it is just as much an alias for eg TXT as it is for A. –  Håkan Lindqvist Apr 25 at 20:06
    
@HåkanLindqvis Then if OP's CNAME points to ec2-xxx-yyy-zzz-aaa.compute-1.amazonaws.com why isn't it resolving? –  Creek Apr 25 at 20:16
    
As the comments and @Sobrique's answer point out the provided information is lacking the necessary information to say what the problem is and the error message does not say that the name did not resolve. (That would normally result in ssh: Could not resolve hostname foo.example.com: Name or service not known) –  Håkan Lindqvist Apr 25 at 20:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.