1

OK, so this just started last week -

Whenever we try to connect to our server via ssh (we use sftp, as well) - The connection times out.

However, when you ssh to any other server and then ssh into the machine - it works flawlessly.

Now, the mindblowing thing is that sometimes the ssh connection will succeed.

Moments ago, I tried it from another machine, and then my own, and it worked - only to time out the next go around.

Last week, simply restarting the ssh daemon worked, but this week, no such luck. I even went in and changed:

/etc/hosts.allow 

ALL : ALL

and

/etc/hosts.deny 

is blank.

The firewall config hasn't changed - but I even disabled the firewall to see if that would work - It did, for a moment - before cutting off, again. (ufw is set to "ALLOW" not "LIMIT")

When I try SSH'ing in from my phone -- it works, fine --

So, it seems the problem is with our ISP/router/gateway - However, I see no log in the router/gateway that says its blocking our connections -

And that wouldn't explain why we can SSH into any other server -- except for this one - from our network ---

I truly appreciate any insight that anyone may have on this matter -

9
  • 2
    Are you using fail2ban on your server by any chance? I've seen this behaviour on boxes where fail2ban was running and where too many incorrect login attempts where being made, causing fail2ban to block the IP.
    – Teun Vink
    Nov 11, 2013 at 15:11
  • I'll check, but the strange thing is that it doesn't consistently block the IP - we can get in, sometimes - Is that the sort of behavior fail2ban creates? I uninstalled it, and it seems to be working, now -- But the funny thing is, I was able to log in via the IP in question -
    – rm-vanda
    Nov 11, 2013 at 15:22
  • 1
    Yes, fail2ban blocks an IP for a specific amount of time after too many login failures. After that time, the IP is unblocked.
    – Teun Vink
    Nov 11, 2013 at 15:29
  • Well, that's strange, since we're using SSH-keys - Everything works flawlessly, now, though - so if that solution continues to work, I'll accept that as the right answer -
    – rm-vanda
    Nov 11, 2013 at 15:47
  • Do other services work while SSH is timing out? For example, can you still ping the server OK?
    – jlehtinen
    Nov 11, 2013 at 15:49

2 Answers 2

2

One cause of this behaviour I know of is fail2ban. This program blocks SSH access when too many bad logins are seen within a specific timeframe. This can be both password logins and key based logins. After a specified time the IP address is unblocked again.

Check your server if fail2ban is installed and if is check your logs for blacklisting actions. If fail2ban is blocking your host every now and thn, you should be able to check in your auth logs which user/key is causing these problems. fail2ban supports IP whitelisting, so you can prevent trusted IP's from ever being blacklisted.

1

I've had this happen when DNS resolves intermittently or slowly.

Check that you have a valid nameserver in your /etc/resolv.conf on the server side, and that an nslookup or dig on your client IP resolves a name without timing out.

You may even test by adding an entry to /etc/hosts for the IP and hostname for the machine you are connecting from, in the servers hosts file.

1
  • This is also a good answer - and I was beginning to suspect it might some DNS issue, since it turned out that we were using IP's for all of the servers we were using to SSH into the server in question-- However, adding our IP to fail2ban's whitelist seems to have solved the problem flawlessly. Thank you for your input, though!
    – rm-vanda
    Nov 12, 2013 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .