I have a Debian 8 server but since a few days ago, my server provider is showing me that SSh is disabled, but it still pings, and HTTP / HTTPS are enabled. I have to add that I'm a newbie in this server world, I know the basics but not much else
The last thing I remember touching was the sshd_config file, but I put back everything as it was first (Double checked with another server of mine that I didn't touch)
So, when I put my server in rescue mode and I do
grep 'sshd' /var/log/auth.log
I get the following:
Aug 17 12:23:44 vpsxxxxxx sshd: pam_unix(sshd:session): session opened for user root by (uid=0) Aug 17 12:23:44 vpsxxxxxx sshd: Received disconnect from yy.yy.yy.yy: 11: disconnected by user Aug 17 12:23:44 vpsxxxxxx sshd: pam_unix(sshd:session): session closed for user root Aug 17 12:26:28 vpsxxxxxx sshd: error: Could not load host key: /etc/ssh/ssh_host_ed25519_key Aug 17 12:26:28 vpsxxxxxx sshd: Connection closed by xx.xx.xx.xx [preauth] Aug 17 12:26:52 vpsxxxxxx sshd: error: Could not load host key: /etc/ssh/ssh_host_ed25519_key Aug 17 12:26:58 vpsxxxxxx sshd: Accepted password for root from xx.xx.xx.xx port 65429 ssh2 Aug 17 12:26:58 vpsxxxxxx sshd: pam_unix(sshd:session): session opened for user root by (uid=0)
I've seen maybe more than 2 solutions that I tried: running
ssh-keygen -A, purgin openssh-server and reinstalling it, but nothing works: the same error about the same key that fails loading keeps showing up, and my connection is still getting refused when I try to log.
What else can I try?
Here is the output of the
ssh -v root@vpsxxxxxx:
OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 56: Applying options for * debug1: Connecting to vps308451.ovh.net [220.127.116.11] port 22. debug1: connect to address 18.104.22.168 port 22: Connection refused ssh: connect to host vps308451.ovh.net port 22: Connection refused
Please don't tell me it's a syntax / human error...
Totally forgot about the other 2 questions, sorry about that
I do have the
HostKey /etc/ssh/ssh_host_ed25519_key line in my
sshd_config file, and
ls -la of the /etc/ssh/ directory outputs the following:
drwxr-xr-x 2 root root 4096 Aug 17 13:44 . drwxr-xr-x 88 root root 4096 Aug 17 13:28 .. -rw-r--r-- 1 root root 242091 Jul 22 2016 moduli -rw-r--r-- 1 root root 1704 Aug 17 13:27 ssh_config -rw-r--r-- 1 root root 2528 Jun 20 08:29 sshd_config -rw------- 1 root root 672 Aug 17 13:27 ssh_host_dsa_key -rw-r--r-- 1 root root 604 Aug 17 13:27 ssh_host_dsa_key.pub -rw------- 1 root root 227 Aug 17 13:27 ssh_host_ecdsa_key -rw-r--r-- 1 root root 176 Aug 17 13:27 ssh_host_ecdsa_key.pub -rw------- 1 root root 411 Aug 17 13:44 ssh_host_ed25519_key -rw-r--r-- 1 root root 97 Aug 17 13:44 ssh_host_ed25519_key.pub -rw------- 1 root root 980 Aug 17 13:44 ssh_host_key -rw-r--r-- 1 root root 645 Aug 17 13:44 ssh_host_key.pub -rw------- 1 root root 1675 Aug 17 13:27 ssh_host_rsa_key -rw-r--r-- 1 root root 396 Aug 17 13:27 ssh_host_rsa_key.pub
I have to report something however, when I went to the folder to do a 'ls -la', the ssh_host_ed25519_key file wasn't there (I recreated it with
keygen-ssh -A but I already tried this just a few hours ago and it didn't work)
As for the permissions, I have no clue wether if the output is good or bad...
root@rescue-pro:/etc/ssh# ps -auwx | grep ssh root 868 0.0 0.2 55184 5460 ? Ss 13:27 0:00 /usr/sbin/sshd -D root 7982 0.0 0.2 82680 5860 ? Ss 13:33 0:00 sshd: root@pts/0 root 8009 0.0 0.1 13208 2160 pts/0 S+ 13:55 0:00 grep ssh
root@rescue-pro:/home# netstat -lntp | grep sshd tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 868/sshd tcp6 0 0 :::22 :::* LISTEN 868/sshd
Edit 4 : sshd_config file
# Package generated configuration file # See the sshd_config(5) manpage for details # What ports, IPs and protocols we listen for Port 22 # Use these options to restrict which interfaces/protocols sshd will bind to #ListenAddress :: #ListenAddress 0.0.0.0 Protocol 2 # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ed25519_key #Privilege Separation is turned on for security UsePrivilegeSeparation yes # Lifetime and size of ephemeral version 1 server key KeyRegenerationInterval 3600 ServerKeyBits 1024 # Logging SyslogFacility AUTH LogLevel INFO # Authentication: LoginGraceTime 120 PermitRootLogin yes StrictModes yes RSAAuthentication yes PubkeyAuthentication yes #AuthorizedKeysFile %h/.ssh/authorized_keys # Don't read the user's ~/.rhosts and ~/.shosts files IgnoreRhosts yes # For this to work you will also need host keys in /etc/ssh_known_hosts RhostsRSAAuthentication no # similar for protocol version 2 HostbasedAuthentication no # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication #IgnoreUserKnownHosts yes # To enable empty passwords, change to yes (NOT RECOMMENDED) PermitEmptyPasswords no # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) ChallengeResponseAuthentication no # Change to no to disable tunnelled clear text passwords #PasswordAuthentication yes # Kerberos options #KerberosAuthentication no #KerberosGetAFSToken no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes #UseLogin no #MaxStartups 10:30:60 #Banner /etc/issue.net # Allow client to pass locale environment variables AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. UsePAM yes
You guys are my last hope before formatting/reinstalling all