1

I'm trying to debug a problem I have when trying to connect to an SSH host over WAN. I'm looking for a way to confirm that my client is reaching the correct host, and is not routed somewhere else along the way. I have access to both the client and he host. Maybe there a way to monitor every SSH connection request on the host's side to confirm that my request is actually reaching it?

The host is a Raspberry Pi running Raspbian, SSH version is OpenSSH_6.0p1 Debian-4, OpenSSL 1.0.1e 11 Feb 2013.

  • @jasonwryan Yes. You can find it in the link I posted. – Abdul Jan 27 '14 at 7:54
4

Two things you can do:

  1. Read the log files on the server. Which logfile will depend on how your system is configured; start by looking for /var/log/secure and /var/log/messages. If you can't find sshd logs there, check your syslog config for where authpriv messages go.

  2. Check the SSH public key returned by the server. Do this by running the command

    ssh-keyscan hostname > hostname-lan.pub on the lan , and

    ssh-keyscan hostname > hostname-wan.pub on WAN.

    Then compare the two files (diff hostname-lan.pub hostname-wan.pub). If you're reaching the same server, there should be no difference. (Unless you're using different hostnames; in that case, the hostname will differ but the rest of the key will be the same.)

  • Thank you so much! Using ssh-keyscan showed me that when I connect through WAN, it connects to a dropbear server instead of an OpenSSH. Turns out I had enabled SSH on my Tomato router ages ago on the same port and had forgotten about it! I disabled SSH on the router, and all is good. – Abdul Jan 27 '14 at 8:29
  • Hah, that explains why we couldn't figure out the problem in the other question! I should have thought of that... – Jenny D Jan 27 '14 at 8:34
0

Maybe there a way to monitor every SSH connection request on the host's side to confirm that my request is actually reaching it?

Yes, sshd will produce copious log output on the host which looks like:

Jan 26 13:49:55 Argon sshd[9928]: Connection from 1.2.3.4 port 42774
Jan 26 13:49:56 Argon sshd[9928]: Found matching DSA key: ...
Jan 26 13:49:56 Argon sshd[9928]: Postponed publickey for joseph from 1.2.3.4 port 42774 ssh2 [preauth]
Jan 26 13:49:56 Argon sshd[9928]: Found matching DSA key: ...
Jan 26 13:49:56 Argon sshd[9928]: Accepted publickey for joseph from 1.2.3.4 port 42774 ssh2
Jan 26 13:49:56 Argon sshd[9928]: pam_unix(sshd:session): session opened for user joseph by (uid=0)
Jan 26 13:49:56 Argon sshd[9928]: User child is on pid 9933
Jan 26 13:50:32 Argon sshd[9933]: Received disconnect from 1.2.3.4: 11: disconnected by user
Jan 26 13:50:32 Argon sshd[9928]: pam_unix(sshd:session): session closed for user joseph

By default, these messages are too low priority to show up in the standard Debian logs. You may have to adjust either sshd or the syslog daemon accordingly. If your Raspbian host is similar to my Debian machine (it should be), then create the file /etc/rsyslog.d/everything.conf with the contents:

*.info                       -/var/log/everything

This will cause all log messages of level info or above to appear in the file /var/log/everything. This should give you output similar to my example above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.