SSH only accepts connections shortly after bootIs it normal to get hundreds of break-in attempts per day?How...
What did “the good wine” (τὸν καλὸν οἶνον) mean in John 2:10?
Did Ender ever learn that he killed Stilson and/or Bonzo?
Python if-else code style for reduced code for rounding floats
Is it normal that my co-workers at a fitness company criticize my food choices?
Have the tides ever turned twice on any open problem?
Why does overlay work only on the first tcolorbox?
Why is the President allowed to veto a cancellation of emergency powers?
Math equation in non italic font
How to write cleanly even if my character uses expletive language?
Is there a hypothetical scenario that would make Earth uninhabitable for humans, but not for (the majority of) other animals?
How to deal with taxi scam when on vacation?
How could an airship be repaired midflight?
Recruiter wants very extensive technical details about all of my previous work
What is the Japanese sound word for the clinking of money?
Are Roman Catholic priests ever addressed as pastor
Instead of a Universal Basic Income program, why not implement a "Universal Basic Needs" program?
Shortcut for setting origin to vertex
Is a party consisting of only a bard, a cleric, and a warlock functional long-term?
Do I need to be arrogant to get ahead?
My adviser wants to be the first author
Tikz picture of two mathematical functions
Equivalents to the present tense
Print a physical multiplication table
Is it true that good novels will automatically sell themselves on Amazon (and so on) and there is no need for one to waste time promoting?
SSH only accepts connections shortly after boot
Is it normal to get hundreds of break-in attempts per day?How to recover from “Too many Authentication Failures for user root”Cannot log in to server after SSH port changeSSH Connection Refused after Ubuntu Server Upgradessh client problem: Connection reset by peerProblem with upgrading OpenSSH to the latest versionssh refused all connect after one connect failedSSH between two Virtualbox guestsI got error ssh: connect to host SOME_HOST port 22: Connection refused on CentOS 5.6 after running Yum updatessh tunnel refusing connections with “channel 2: open failed”Unable to SSH into ec2 after reboot
When I tried to log into my remote Ubuntu server today, I got:
ssh: connect to host <ip> port 22: Connection refused
So I rebooted the server, thinking sshd might have crashed.
After the boot I could connect via ssh, but after 1 or 2 minutes the server closed the connection:
Connection to <ip> closed by remote host.
Trying to reconnect, the server refuses the connection again.
Manually doing
/etc/init.d/sshd restart
didn't help, /etc/hosts.deny seems ok.
This is extremely annoying, since I have so little time to diagnose or fix the problem.
Help or ideas are greatly appreciated!
ubuntu ssh
asked Jul 20 '11 at 15:59
Anselm EickhoffAnselm Eickhoff
1061
bumped to the homepage by Community♦ 7 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
When I tried to log into my remote Ubuntu server today, I got:
ssh: connect to host <ip> port 22: Connection refused
So I rebooted the server, thinking sshd might have crashed.
After the boot I could connect via ssh, but after 1 or 2 minutes the server closed the connection:
Connection to <ip> closed by remote host.
Trying to reconnect, the server refuses the connection again.
Manually doing
/etc/init.d/sshd restart
didn't help, /etc/hosts.deny seems ok.
This is extremely annoying, since I have so little time to diagnose or fix the problem.
Help or ideas are greatly appreciated!
ubuntu ssh
asked Jul 20 '11 at 15:59
Anselm EickhoffAnselm Eickhoff
1061
bumped to the homepage by Community♦ 7 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
2
How about a firewall that starts some time after boot? Does that block your connection? Is the sshd still listening on port 22 when you can't connect? Are there any log messages in the system log?
– mailq
Jul 20 '11 at 16:06
Please take a brief excursion through your log files looking for things that seem abnormal or indicative of a problem -- We will be better able to help you with that information.
– voretaq7
Jul 20 '11 at 16:27
I did angrep -ir ssh /var/log/*and found nothing interesting or related, but some people seem to be spamming my ssh like crazy (ddos style) trying to log in as root (the events are usually some weeks apart) WTF!
– Anselm Eickhoff
Jul 20 '11 at 17:02
@Anselm that's normal, sadly: serverfault.com/q/244614/65089
– Michael Lowman
Jul 20 '11 at 19:51
add a comment |
When I tried to log into my remote Ubuntu server today, I got:
ssh: connect to host <ip> port 22: Connection refused
So I rebooted the server, thinking sshd might have crashed.
After the boot I could connect via ssh, but after 1 or 2 minutes the server closed the connection:
Connection to <ip> closed by remote host.
Trying to reconnect, the server refuses the connection again.
Manually doing
/etc/init.d/sshd restart
didn't help, /etc/hosts.deny seems ok.
This is extremely annoying, since I have so little time to diagnose or fix the problem.
Help or ideas are greatly appreciated!
ubuntu ssh
asked Jul 20 '11 at 15:59
Anselm EickhoffAnselm Eickhoff
1061
When I tried to log into my remote Ubuntu server today, I got:
ssh: connect to host <ip> port 22: Connection refused
So I rebooted the server, thinking sshd might have crashed.
After the boot I could connect via ssh, but after 1 or 2 minutes the server closed the connection:
Connection to <ip> closed by remote host.
Trying to reconnect, the server refuses the connection again.
Manually doing
/etc/init.d/sshd restart
didn't help, /etc/hosts.deny seems ok.
This is extremely annoying, since I have so little time to diagnose or fix the problem.
Help or ideas are greatly appreciated!
ubuntu ssh
ubuntu ssh
asked Jul 20 '11 at 15:59
Anselm EickhoffAnselm Eickhoff
1061
asked Jul 20 '11 at 15:59
Anselm EickhoffAnselm Eickhoff
1061
asked Jul 20 '11 at 15:59
Anselm EickhoffAnselm Eickhoff
1061
asked Jul 20 '11 at 15:59
Anselm EickhoffAnselm Eickhoff
1061
asked Jul 20 '11 at 15:59
Anselm EickhoffAnselm Eickhoff
1061
1061
bumped to the homepage by Community♦ 7 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ 7 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
2
How about a firewall that starts some time after boot? Does that block your connection? Is the sshd still listening on port 22 when you can't connect? Are there any log messages in the system log?
– mailq
Jul 20 '11 at 16:06
Please take a brief excursion through your log files looking for things that seem abnormal or indicative of a problem -- We will be better able to help you with that information.
– voretaq7
Jul 20 '11 at 16:27
I did angrep -ir ssh /var/log/*and found nothing interesting or related, but some people seem to be spamming my ssh like crazy (ddos style) trying to log in as root (the events are usually some weeks apart) WTF!
– Anselm Eickhoff
Jul 20 '11 at 17:02
@Anselm that's normal, sadly: serverfault.com/q/244614/65089
– Michael Lowman
Jul 20 '11 at 19:51
add a comment |
2
How about a firewall that starts some time after boot? Does that block your connection? Is the sshd still listening on port 22 when you can't connect? Are there any log messages in the system log?
– mailq
Jul 20 '11 at 16:06
Please take a brief excursion through your log files looking for things that seem abnormal or indicative of a problem -- We will be better able to help you with that information.
– voretaq7
Jul 20 '11 at 16:27
I did angrep -ir ssh /var/log/*and found nothing interesting or related, but some people seem to be spamming my ssh like crazy (ddos style) trying to log in as root (the events are usually some weeks apart) WTF!
– Anselm Eickhoff
Jul 20 '11 at 17:02
@Anselm that's normal, sadly: serverfault.com/q/244614/65089
– Michael Lowman
Jul 20 '11 at 19:51
2
2
How about a firewall that starts some time after boot? Does that block your connection? Is the sshd still listening on port 22 when you can't connect? Are there any log messages in the system log?
– mailq
Jul 20 '11 at 16:06
How about a firewall that starts some time after boot? Does that block your connection? Is the sshd still listening on port 22 when you can't connect? Are there any log messages in the system log?
– mailq
Jul 20 '11 at 16:06
Please take a brief excursion through your log files looking for things that seem abnormal or indicative of a problem -- We will be better able to help you with that information.
– voretaq7
Jul 20 '11 at 16:27
Please take a brief excursion through your log files looking for things that seem abnormal or indicative of a problem -- We will be better able to help you with that information.
– voretaq7
Jul 20 '11 at 16:27
I did an
grep -ir ssh /var/log/* and found nothing interesting or related, but some people seem to be spamming my ssh like crazy (ddos style) trying to log in as root (the events are usually some weeks apart) WTF!– Anselm Eickhoff
Jul 20 '11 at 17:02
I did an
grep -ir ssh /var/log/* and found nothing interesting or related, but some people seem to be spamming my ssh like crazy (ddos style) trying to log in as root (the events are usually some weeks apart) WTF!– Anselm Eickhoff
Jul 20 '11 at 17:02
@Anselm that's normal, sadly: serverfault.com/q/244614/65089
– Michael Lowman
Jul 20 '11 at 19:51
@Anselm that's normal, sadly: serverfault.com/q/244614/65089
– Michael Lowman
Jul 20 '11 at 19:51
add a comment |
1 Answer
1
active
oldest
votes
When the error message is "Connection refused" it means that sshd is no longer listening on your ssh port. If it was your firewall, you would have received a "Timeout". In either case, do ssh with verbose option and see exactly at what step the connection is getting dropped.
answered Jul 20 '11 at 19:40
SparXSparX
1,863910
Connection refused is likely to be iptables as well, if the "-j reject" is used.
– Rilindo
Jul 20 '11 at 21:01
Thats a good catch :)
– SparX
Jul 21 '11 at 1:11
sparx.me: with the verbose option ssh gives me:OpenSSH_5.8p1 Debian-1ubuntu3, OpenSSL 0.9.8o 01 Jun 2010 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to <url> [<ip>] port 22. debug1: connect to address <ip> port 22: Connection refused ssh: connect to host <url> port 22: Connection refused
– Anselm Eickhoff
Jul 21 '11 at 10:40
Rilindo: I will find out what -j reject does for iptables and report back (I'm a noob admin so I have to learn)
– Anselm Eickhoff
Jul 21 '11 at 10:43
Can you connect locally inside the server itself? Like this: ssh localhost
– Rilindo
Jul 21 '11 at 14:18
|
show 1 more comment
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "2"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f292336%2fssh-only-accepts-connections-shortly-after-boot%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
When the error message is "Connection refused" it means that sshd is no longer listening on your ssh port. If it was your firewall, you would have received a "Timeout". In either case, do ssh with verbose option and see exactly at what step the connection is getting dropped.
answered Jul 20 '11 at 19:40
SparXSparX
1,863910
Connection refused is likely to be iptables as well, if the "-j reject" is used.
– Rilindo
Jul 20 '11 at 21:01
Thats a good catch :)
– SparX
Jul 21 '11 at 1:11
sparx.me: with the verbose option ssh gives me:OpenSSH_5.8p1 Debian-1ubuntu3, OpenSSL 0.9.8o 01 Jun 2010 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to <url> [<ip>] port 22. debug1: connect to address <ip> port 22: Connection refused ssh: connect to host <url> port 22: Connection refused
– Anselm Eickhoff
Jul 21 '11 at 10:40
Rilindo: I will find out what -j reject does for iptables and report back (I'm a noob admin so I have to learn)
– Anselm Eickhoff
Jul 21 '11 at 10:43
Can you connect locally inside the server itself? Like this: ssh localhost
– Rilindo
Jul 21 '11 at 14:18
|
show 1 more comment
When the error message is "Connection refused" it means that sshd is no longer listening on your ssh port. If it was your firewall, you would have received a "Timeout". In either case, do ssh with verbose option and see exactly at what step the connection is getting dropped.
answered Jul 20 '11 at 19:40
SparXSparX
1,863910
Connection refused is likely to be iptables as well, if the "-j reject" is used.
– Rilindo
Jul 20 '11 at 21:01
Thats a good catch :)
– SparX
Jul 21 '11 at 1:11
sparx.me: with the verbose option ssh gives me:OpenSSH_5.8p1 Debian-1ubuntu3, OpenSSL 0.9.8o 01 Jun 2010 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to <url> [<ip>] port 22. debug1: connect to address <ip> port 22: Connection refused ssh: connect to host <url> port 22: Connection refused
– Anselm Eickhoff
Jul 21 '11 at 10:40
Rilindo: I will find out what -j reject does for iptables and report back (I'm a noob admin so I have to learn)
– Anselm Eickhoff
Jul 21 '11 at 10:43
Can you connect locally inside the server itself? Like this: ssh localhost
– Rilindo
Jul 21 '11 at 14:18
|
show 1 more comment
When the error message is "Connection refused" it means that sshd is no longer listening on your ssh port. If it was your firewall, you would have received a "Timeout". In either case, do ssh with verbose option and see exactly at what step the connection is getting dropped.
answered Jul 20 '11 at 19:40
SparXSparX
1,863910
When the error message is "Connection refused" it means that sshd is no longer listening on your ssh port. If it was your firewall, you would have received a "Timeout". In either case, do ssh with verbose option and see exactly at what step the connection is getting dropped.
answered Jul 20 '11 at 19:40
SparXSparX
1,863910
answered Jul 20 '11 at 19:40
SparXSparX
1,863910
answered Jul 20 '11 at 19:40
SparXSparX
1,863910
answered Jul 20 '11 at 19:40
SparXSparX
1,863910
1,863910
Connection refused is likely to be iptables as well, if the "-j reject" is used.
– Rilindo
Jul 20 '11 at 21:01
Thats a good catch :)
– SparX
Jul 21 '11 at 1:11
sparx.me: with the verbose option ssh gives me:OpenSSH_5.8p1 Debian-1ubuntu3, OpenSSL 0.9.8o 01 Jun 2010 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to <url> [<ip>] port 22. debug1: connect to address <ip> port 22: Connection refused ssh: connect to host <url> port 22: Connection refused
– Anselm Eickhoff
Jul 21 '11 at 10:40
Rilindo: I will find out what -j reject does for iptables and report back (I'm a noob admin so I have to learn)
– Anselm Eickhoff
Jul 21 '11 at 10:43
Can you connect locally inside the server itself? Like this: ssh localhost
– Rilindo
Jul 21 '11 at 14:18
|
show 1 more comment
Connection refused is likely to be iptables as well, if the "-j reject" is used.
– Rilindo
Jul 20 '11 at 21:01
Thats a good catch :)
– SparX
Jul 21 '11 at 1:11
sparx.me: with the verbose option ssh gives me:OpenSSH_5.8p1 Debian-1ubuntu3, OpenSSL 0.9.8o 01 Jun 2010 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to <url> [<ip>] port 22. debug1: connect to address <ip> port 22: Connection refused ssh: connect to host <url> port 22: Connection refused
– Anselm Eickhoff
Jul 21 '11 at 10:40
Rilindo: I will find out what -j reject does for iptables and report back (I'm a noob admin so I have to learn)
– Anselm Eickhoff
Jul 21 '11 at 10:43
Can you connect locally inside the server itself? Like this: ssh localhost
– Rilindo
Jul 21 '11 at 14:18
Connection refused is likely to be iptables as well, if the "-j reject" is used.
– Rilindo
Jul 20 '11 at 21:01
Connection refused is likely to be iptables as well, if the "-j reject" is used.
– Rilindo
Jul 20 '11 at 21:01
Thats a good catch :)
– SparX
Jul 21 '11 at 1:11
Thats a good catch :)
– SparX
Jul 21 '11 at 1:11
sparx.me: with the verbose option ssh gives me:
OpenSSH_5.8p1 Debian-1ubuntu3, OpenSSL 0.9.8o 01 Jun 2010 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to <url> [<ip>] port 22. debug1: connect to address <ip> port 22: Connection refused ssh: connect to host <url> port 22: Connection refused– Anselm Eickhoff
Jul 21 '11 at 10:40
sparx.me: with the verbose option ssh gives me:
OpenSSH_5.8p1 Debian-1ubuntu3, OpenSSL 0.9.8o 01 Jun 2010 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to <url> [<ip>] port 22. debug1: connect to address <ip> port 22: Connection refused ssh: connect to host <url> port 22: Connection refused– Anselm Eickhoff
Jul 21 '11 at 10:40
Rilindo: I will find out what -j reject does for iptables and report back (I'm a noob admin so I have to learn)
– Anselm Eickhoff
Jul 21 '11 at 10:43
Rilindo: I will find out what -j reject does for iptables and report back (I'm a noob admin so I have to learn)
– Anselm Eickhoff
Jul 21 '11 at 10:43
Can you connect locally inside the server itself? Like this: ssh localhost
– Rilindo
Jul 21 '11 at 14:18
Can you connect locally inside the server itself? Like this: ssh localhost
– Rilindo
Jul 21 '11 at 14:18
|
show 1 more comment
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f292336%2fssh-only-accepts-connections-shortly-after-boot%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
How about a firewall that starts some time after boot? Does that block your connection? Is the sshd still listening on port 22 when you can't connect? Are there any log messages in the system log?
– mailq
Jul 20 '11 at 16:06
Please take a brief excursion through your log files looking for things that seem abnormal or indicative of a problem -- We will be better able to help you with that information.
– voretaq7
Jul 20 '11 at 16:27
I did an
grep -ir ssh /var/log/*and found nothing interesting or related, but some people seem to be spamming my ssh like crazy (ddos style) trying to log in as root (the events are usually some weeks apart) WTF!– Anselm Eickhoff
Jul 20 '11 at 17:02
@Anselm that's normal, sadly: serverfault.com/q/244614/65089
– Michael Lowman
Jul 20 '11 at 19:51