Networking issue

DISCUSSION Adam Luchjenbroers (by way of Adam Luchjenbroers <[email protected]>) 2 participants 4 messages Jan 3, 2003

lore

Share & tools

lore

Adam Luchjenbroers (by way of Adam Luchjenbroers <[email protected]>)

author

2003-01-03 05:27 UTC #0 lore raw

Quoted 1 line

1. What system is gtelnet running on?

Workstation, running mandrake 9.0

Quoted 4 lines

3. From the Mandrake system, can you ssh to localhost (or to 127.0.0.1)? If not, EXACTLY what error does the ssh client report? (If you don't have an ssh client installed, see what "telnet localhost 22" does. It should display the banner from the sshd daemon.)

Its a very minimal install on the server, it has neither ssh or telnet
clients

Quoted 2 lines

4. When gtelnet "then fails", does it display any sort of error message? If you are interpreting no response as a failure, how long are you waiting?

I wait until the status display goes from displaying "connected" until it
goes to "not connected"

tried to connect using the ssh command, got this error

ssh_exchange_identification: Connection closed by remote host

Quoted 5 lines

5. In the ifconfig output you posted here, there are packet counts for RX and TX packets on each interface. After you try and fail to ssh from the wworkstation to the server, are the server's eth0 packet counts higher? If ssh'ing to localhost on the server also fails, the same question for its lo interface.

RX/TX values do increase.

Quoted 5 lines

6. I'm assuming you are running sshd as a daemon and not through inetd. But let's check the basics here. So ...
A. If you do a "ps ax | grep ssh", does sshd show up on the
process list?

yes

Quoted 3 lines

B. If you do a "netstat -nl", does port 22 show up on the list? It
will be a line something like this:
         tcp        0      0 0.0.0.0:22              0.0.0.0:*   LISTEN

yes

Quoted 4 lines

7. After a failure, does sshd log anything? I'm not sure how Mandrake keeps its logs, but something like this should work (as root):
grep sshd /var/log/*

log files are stored there, but can't tell which one belongs to ssh

Quoted 3 lines

8. Finally, do you have anything in your configuration that blocks ssh connects from this workstation? Are there any relevant entries in /etc/hosts.deny?

Quoted 1 line

There are probably more things to check, but this set is a good start.

On another note, I corrected the system clock on tthe server (it thought it was 1998) now one of my user accounts has expired, how do I reactiveate it.

--
"You can bring any calculator you like to the midterm, as long as it doesn't dim the lights when you turn it on." - Hepler, Systems Design 182

Please avoid sending me Word or PowerPoint attachments. See http://www.fsf.org/philosophy/no-word-attachments.html

-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Ray Olszewski

2003-01-03 07:09 UTC #1 lore raw

At 02:57 PM 1/3/03 +0930, Adam Luchjenbroers wrote:
[...]

Quoted 9 lines

Quoted 2 lines
4. When gtelnet "then fails", does it display any sort of error message? If you are interpreting no response as a failure, how long are you waiting?
I wait until the status display goes from displaying "connected" until it
goes to "not connected"
tried to connect using the ssh command, got this error
ssh_exchange_identification: Connection closed by remote host

This (combined with other details of your reply, omitted here) suggests that the problem is authentication. How do you have sshd set to expect connections to authenticate? (The choices are in sshd's config file, probably /etc/ssh/sshd_conf .) How do you have gtelnet set to attempt to authenticate (I'm not familiar with this client so can't tell you how to check this)?

[...]

Quoted 2 lines

On another note, I corrected the system clock on tthe server (it thought it was 1998) now one of my user accounts has expired, how do I reactiveate it.

Accounts don't normally expire, so either I am misunderstanding your description or you are using something peculiar to Mandrake 9.0. In either case, I need to leave it to someone else to help with this one.

--
-------------------------------------------"Never tell me the odds!"--------
Ray Olszewski -- Han Solo
Palo Alto, California, USA [email protected]
-------------------------------------------------------------------------------

Adam Luchjenbroers

author

2003-01-03 11:31 UTC #2 lore raw

On Friday 03 Jan 2003 4:39 pm, Ray Olszewski wrote:

Got everything pretty much fixed, except for one thing.

Something perioically seems to re-add a line to hosts.deny that forbids connections from everything but localhost. /proc/sys/net/ipv4/icmp_echo_ignore_all also gets reset to 1 (but this happened at a different time)

/var/spool/cron has no entries

How can I find the problem?

Signature · 11 lines

"MS-DOS is to computing as the black plague was to Europe" - NH

Please avoid sending me Word or PowerPoint attachments.
See http://www.fsf.org/philosophy/no-word-attachments.html


-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Ray Olszewski

2003-01-03 16:20 UTC #3 lore raw

Quoted 10 lines · Adam Luchjenbroers

On Friday 03 Jan 2003 4:39 pm, Ray Olszewski wrote:
Got everything pretty much fixed, except for one thing.
Something perioically seems to re-add a line to hosts.deny that forbids connections from everything but localhost. /proc/sys/net/ipv4/icmp_echo_ignore_all also gets reset to 1 (but this happened at a different time)
/var/spool/cron has no entries

I infer (from the comment about cron) that these changes occur while the server is running, rather than as the result of a reboot. And when you say "/var/spool/cron has no entries", I understand you to mean that it does not have the usual subdirectories (since /var/spool/cron is a directory, not a file). Beyond that ... you'd get better help from someone who uses Mandrake than from a Debian user like me, since this behavior most likely reflects something idiosyncratic to Mandrake.

So ... all I can offer is some reflection on how I'd try to investigate an unknown problem of this sort. Putting aside obvious things like a Google search, I'd first try to ping down "periodically" to a more precise value.

When you discover the change in /etc/hosts.deny, what is the timestamp on the file?

Look through your process list and see if there is some daemon running that might do things like this. Have you installed a firewall package (though I'd be astounded if Shorewall, the one you mentioned trying, did anything this silly ... it is a well-designed app)?

Might one of the other cron-job files (the ones in /etc) be running something that makes these changes?

For example, is something running one of your init scripts with the "restart" switch? Check (using "grep") all the init scripts (does Mandrake keep these in /etc/init.d or somewhere else?) for any references to hosts.deny or "icmp_echo".

That's about all I can think of for starters.