1

A friend approached me about what appeared initially to be a Wordpress issue on a blog hosted on a Linux box; Wordpress was not upgrading XYZ at first attempt. I tried to get some diagnostics and maybe manually update Wordpress, only to find that trying to use putty to ssh in as root@[deleted].com was rejected. I logged into an unrelated NetBSD box and tried to ssh in, and got:

haywardfamily ~ {501}: ssh root@[deleted].com
ssh_exchange_identification: Connection closed by remote host

After a couple of tries from this computer, he went over to another machine to confirm behavior and got blocked two times, then logged in successfully on the third time. Furthermore, I saw him use an sftp client to successfully connect and interact with the server.

Has the box been rooted? I'm not sure what can be done if we can't connect, but if we do succeed in getting an ssh connection as root, what can/should be done to restore regular access?

What are next diagnostic / repair steps from here?

Thanks,

Improve this question
1
  • The next diagnostic step would be a more verbose ssh output. This will give a clue about what is happening in the background. ssh -vv user@host will be a good start. Then we can take it from there later :-)
    – user894627
    Apr 5, 2014 at 18:29

1 Answer 1

Reset to default
1

It is generally considered good practice to disable root logins. Users should login with their own account, then use sudo.

It is a very common attack vector to try to break root's password and therefore getting privileged access to your box. Your friend's box maybe configured to disable an account for a period of time if there has been too many failed attempts to login.

Improve this answer
4
  • Thank you; I added an unprivileged user and that user has had similarly flaky results to trying to log in. Any reason why paul@[deleted].com would not be allowed in?
    – Christos Hayward
    Apr 5, 2014 at 17:59
  • That does make it a bit more interesting! ;) What does your auth logs say? Other logs? Is your latency fluctuating, or is it stable? Are you suffering any pack loss? Once you have established a connection, can you ssh to the local box without any problems? Try ssh'ing to the ip addresses vs the dns hostname.
    – David
    Apr 5, 2014 at 18:04
  • How about other services, eg http? Are they working normally?
    – David
    Apr 5, 2014 at 18:07
  • @christos-hayward This is an old thread, but an interesting one. I wonder if you were able to solve it, and what was the issue.
    – Henrique
    Aug 5, 2019 at 17:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .