0

My Problem: I can not connect to external SSH servers ("Uberspace" and "GitHub") from my Arco Linux PC und if I try to connect to internal SSH servers it works but falls back to password authentication.

I used the following SSH clients/servers for testing.

  • local SSH clients (LinuxPC, MBP, Banana,
  • local SSH servers (Banana (192.168.1.57) and MBP (192.168.1.22)) and
  • remote SSH servers (Uberspace (185.26.156.188) and GitHub) for testing

I did the following:

Passed the public keys from LinuxPC and MBP to Banana via ssh-copy-id and to Uberspace and GitHub using their web interfaces. ssh-copy-id from LinuxPC to Uberspace should be possible but throws a "Network is unreachable".

Then I tried to connect via SSH key authentication with the following results:

LinuxPC -> MBP: asks for a password even though I sucessfully ssh-copy-id before. Password works.

LinuxPC -> Banana: asks for a password even though I sucessfully ssh-copy-id before. Password works.

LinuxPC -> Uberspace: connection refused/Network is unreachable

LinuxPC -> GitHub: connection refused

MBP -> Banana: ok with public key auth

MBP -> Uberspace: ok with public key auth

MBP -> GitHub: ok with public key auth

Banana -> Uberspace (Network unreachable, Connection refused)

Banana -> MBP (works fine with public key auth)

Banana -> GitHub (Connection refused)

So it looks like that ...

  • external SSH Servers (Uberspace, GitHub) are connectable from my intranet with public key auth (from MBP)
  • LinuxPC is able to connect to internal Servers with password auth (to MBP and Banana)
  • I can not SSH from LinuxPC with public key auth
  • I can not SSH from LinuxPC to external Servers

My Firewall ist off and LinuxPC and MBP are connected with the same Router (FritzBox). There are no specific settings in the Router so it should behave the same for LinuxPC, MBP and Banana.

The ssh_config from LinuxPC is at the end of this text. Is there something missing or wrong. I have not changed the content.

Any hint or guidance would be great

Many thanks!


Details:

Banana -> Uberspace

bananapi@BANANA ~ $ ssh -v [email protected]
OpenSSH_6.0p1 Debian-4+deb7u2, OpenSSL 1.0.1e 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to elst.uberspace.de [185.26.156.188] port 22.
debug1: connect to address 185.26.156.188 port 22: Connection refused
debug1: Connecting to elst.uberspace.de [2a00:d0c0:200:0:b9:1a:9c:8e] port 22.
debug1: connect to address 2a00:d0c0:200:0:b9:1a:9c:8e port 22: Network is unreachable
ssh: connect to host elst.uberspace.de port 22: Network is unreachable

bananapi@BANANA ~ $ ssh-copy-id [email protected]
ssh: connect to host elst.uberspace.de port 22: Network is unreachable

bananapi@BANANA ~ $ nc -vz 95.143.172.245 22
nc: connect to 95.143.172.245 port 22 (tcp) failed: Connection refused

bananapi@BANANA ~ $ nc -vz 185.26.156.188 22
nc: connect to 185.26.156.188 port 22 (tcp) failed: Connection refused

Banana -> MBP (ok)

bananapi@BANANA ~ $ ssh-copy-id [email protected]
Now try logging into the machine, with "ssh '[email protected]'", and check in:

  ~/.ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.

bananapi@BANANA ~ $ ssh [email protected]
Last login: Tue Jan 12 15:05:18 2021 from 192.168.1.57

The default interactive shell is now zsh.
To update your account to use zsh, please run `chsh -s /bin/zsh`.
For more details, please visit https://support.apple.com/kb/HT208050.

LinuxPC -> MBP (pw only)

[xxx@Linux-PC ~]$ ssh-copy-id [email protected]
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/xxx/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.

[xxx@Linux-PC ~]$ ssh [email protected]
Enter passphrase for key '/home/xxx/.ssh/id_rsa': 
Password:
Last login: Tue Jan 12 15:34:19 2021 from 192.168.1.54

The default interactive shell is now zsh.
To update your account to use zsh, please run `chsh -s /bin/zsh`.
For more details, please visit https://support.apple.com/kb/HT208050.
xxxs-MBP:~ xxx$

note: it asks for a passwort even though I uploaded a pub key before

LinuxPC -> Uberspace

[xxx@Linux-PC ~]$ ssh-copy-id [email protected]
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/xxx/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

/usr/bin/ssh-copy-id: ERROR: ssh: connect to host elst.uberspace.de port 22: Network is unreachable

[xxx@Linux-PC ~]$ ssh -v  [email protected]
OpenSSH_8.4p1, OpenSSL 1.1.1i  8 Dec 2020
debug1: Reading configuration data /home/xxx/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to elst.uberspace.de [185.26.156.188] port 22.
debug1: connect to address 185.26.156.188 port 22: Connection refused
debug1: Connecting to elst.uberspace.de [2a00:d0c0:200:0:b9:1a:9c:8e] port 22.
debug1: connect to address 2a00:d0c0:200:0:b9:1a:9c:8e port 22: Network is unreachable
ssh: connect to host elst.uberspace.de port 22: Network is unreachable

[xxx@Linux-PC pw]$ nc -vz 95.143.172.245 22
vega.uberspace.de [95.143.172.245] 22 (ssh): Verbindungsaufbau abgelehnt
(means connection rejected)

[xxx@Linux-PC pw]$ nc -vz 185.26.156.188 22
elst.uberspace.de [185.26.156.188] 22 (ssh): Verbindungsaufbau abgelehnt
(means connection rejected)

LinuxPC -> Banana (asks for a password even though pub key is uploaded successfully)

[xxx@Linux-PC ~]$ ssh-copy-id -f [email protected]
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/xxx/.ssh/id_rsa.pub"
Enter passphrase for key '/home/xxx/.ssh/id_rsa': 
[email protected]'s password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.

[xxx@Linux-PC ~]$ ssh -v [email protected]
OpenSSH_8.4p1, OpenSSL 1.1.1i  8 Dec 2020
debug1: Reading configuration data /home/xxx/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to 192.168.1.57 [192.168.1.57] port 22.
debug1: Connection established.
debug1: identity file /home/xxx/.ssh/id_rsa type 0
debug1: identity file /home/xxx/.ssh/id_rsa-cert type -1
debug1: identity file /home/xxx/.ssh/id_dsa type -1
debug1: identity file /home/xxx/.ssh/id_dsa-cert type -1
debug1: identity file /home/xxx/.ssh/id_ecdsa type -1
debug1: identity file /home/xxx/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/xxx/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/xxx/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/xxx/.ssh/id_ed25519 type -1
debug1: identity file /home/xxx/.ssh/id_ed25519-cert type -1
debug1: identity file /home/xxx/.ssh/id_ed25519_sk type -1
debug1: identity file /home/xxx/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/xxx/.ssh/id_xmss type -1
debug1: identity file /home/xxx/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.0p1 Debian-4+deb7u2
debug1: match: OpenSSH_6.0p1 Debian-4+deb7u2 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 192.168.1.57:22 as 'bananapi'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: ecdh-sha2-nistp256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: aes128-ctr MBP: [email protected] compression: none
debug1: kex: client->server cipher: aes128-ctr MBP: [email protected] compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:q+j2dQzHWPbthWX4VCK4UK7GDwccoGGZZDSBr4Hl4HE
debug1: Host '192.168.1.57' is known and matches the ECDSA host key.
debug1: Found key in /home/xxx/.ssh/known_hosts:1
debug1: rekey out after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 4294967296 blocks
debug1: Will attempt key: /home/xxx/.ssh/id_rsa RSA SHA256:XDOacvuprzkByJY1ZpGjZN2anPeYVeNkN7v5P6TuBBw
debug1: Will attempt key: /home/xxx/.ssh/id_dsa 
debug1: Will attempt key: /home/xxx/.ssh/id_ecdsa 
debug1: Will attempt key: /home/xxx/.ssh/id_ecdsa_sk 
debug1: Will attempt key: /home/xxx/.ssh/id_ed25519 
debug1: Will attempt key: /home/xxx/.ssh/id_ed25519_sk 
debug1: Will attempt key: /home/xxx/.ssh/id_xmss 
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: /home/xxx/.ssh/id_rsa RSA SHA256:XDOacvuprzkByJY1ZpGjZN2anPeYVeNkN7v5P6TuBBw
debug1: Server accepts key: /home/xxx/.ssh/id_rsa RSA SHA256:XDOacvuprzkByJY1ZpGjZN2anPeYVeNkN7v5P6TuBBw
Enter passphrase for key '/home/xxx/.ssh/id_rsa': 
debug1: Trying private key: /home/xxx/.ssh/id_dsa
debug1: Trying private key: /home/xxx/.ssh/id_ecdsa
debug1: Trying private key: /home/xxx/.ssh/id_ecdsa_sk
debug1: Trying private key: /home/xxx/.ssh/id_ed25519
debug1: Trying private key: /home/xxx/.ssh/id_ed25519_sk
debug1: Trying private key: /home/xxx/.ssh/id_xmss
debug1: Next authentication method: password
[email protected]'s password: 
debug1: Authentication succeeded (password).
Authenticated to 192.168.1.57 ([192.168.1.57]:22).
debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: pledge: network
Linux BANANA 3.4.103 #1 SMP PREEMPT Thu Dec 18 13:07:12 CST 2014 armv7l

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
bananapi@BANANA ~ $ 

MBP -> Uberspace (ok)

xxxs-MBP:~ xxx$ ssh-copy-id -f [email protected]
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/Users/xxx/.ssh/id_rsa.pub"

Number of key(s) added:        1

Now try logging into the machine, with:   "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.

xxxs-MBP:~ xxx$ ssh [email protected]
Last login: Tue Jan 12 14:21:29 2021 from 212.18.221.64
Welcome to Uberspace 7!

Current version: 7.8.1.0
Manual: https://manual.uberspace.de/en/
Watch out for changes at: https://manual.uberspace.de/en/changelog.html
Follow us on Twitter for updates: https://twitter.com/ubernauten

Is something unclear or does not work as expected?
 => check the server status: https://is.uberspace.online
 => reach out to our team: [email protected]
[xxxnc@elst ~]$ 

/etc/ssh/ssh_config

# $OpenBSD: ssh_config,v 1.35 2020/07/17 03:43:42 dtucker Exp $

# This is the ssh client system-wide configuration file. See
# ssh_config(5) for more information. This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.

# Configuration data is parsed as follows:
# 1. command line options
# 2. user-specific file
# 3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.

# Site-wide defaults for some commonly used options. For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.

# Host *
# ForwardAgent no
# ForwardX11 no
# PasswordAuthentication yes
# HostbasedAuthentication no
# GSSAPIAuthentication no
# GSSAPIDelegateCredentials no
# BatchMode no
# CheckHostIP yes
# AddressFamily any
# ConnectTimeout 0
# StrictHostKeyChecking ask
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
# IdentityFile ~/.ssh/id_ecdsa
# IdentityFile ~/.ssh/id_ed25519
# Port 22
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
# MACs hmac-md5,hmac-sha1,[email protected]
# EscapeChar ~
# Tunnel no
# TunnelDevice any:any
# PermitLocalCommand no
# VisualHostKey no
# ProxyCommand ssh -q -W %h:%p gateway.example.com
# RekeyLimit 1G 1h
# UserKnownHostsFile ~/.ssh/known_hosts.d/%k

1 Answer 1

0

Solved it. The Router was blocking the connection. There was different settings for Laptop (Wifi) and PC (LAN) I not expected.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .