First of all, sorry for my English.

We're facing a very strange problem with SSH connection between two specific servers.

Let's say we have X1, X2 and Y servers. Where X1 and X2 are behind the same firewall, have installed the same operating system, use same configurations for everything that's possibly related to the situation.

We don't have any rule set to allow or block only certain IPs or whatever on IPtables on server Y, but anyway... X1 and X2 servers communicate to the exterior using the same IP address.

PROBLEM: Server X1 cannot connect to server Y via SSH. It gets a response on ping, but nothing else, no other service on any other port succeeds to connect.

X2 or any other server succeeds to connect to X1 and X1 succeeds to connect to any other server except Y1.

[root@X1]# ssh -v root@Y1
OpenSSH_4.3p2, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to Y1 [Y1] port 22.
** It stalls here **

We've restarted both servers and firewalls.

We've done a test on trying to connect X1 to Y using different port without configuring that port and instead of getting stalled, we get connection refused. If we configure Y1 SSH daemon to accept connections on that port and do the same test again... it stalls using that newly configured port.

  • 4
    Fire up tcpdump on the client and server. Try to make connect via SSH. See of the packets get to the remote system. – Zoredache Dec 11 '10 at 0:05

I've seen a similar issue before and it was difficult to diagnose. It turned out that X1 was listening on the IP address for Y (but not presenting to the network, I can't remember the specifics). Can you disable ping on Y? Do that and see if X1 can still ping that IP anyway. If it can, you've found the issue now you just need to find the cause.

  • IF we add an entry on server Y iptables to block ICMP ping, servers X1 and X2 have the supposed behaviour. They cannot ping Y. Thanks for your suggestion anyway. – satirio Dec 11 '10 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.