0

When I trying to connect centos 7 server via ssh it connects asks for username password, I enter then login. But after a while, the connection is closed and doesn't response. Then I go to server console, i send a ping to anywhere on internet (sometimes restart network needed) it succeeds. After that i try again ssh connection from client it reconnects, but again after a short time closes the connection again.

When I checked my network status with systemctl status network:

network.service - LSB: Bring up/down networking
   Loaded: loaded (/etc/rc.d/init.d/network; bad; vendor preset: disabled)
   Active: active (exited) since Thu 2022-02-17 10:28:03 +03; 43min ago
     Docs: man:systemd-sysv-generator(8)
  Process: 4314 ExecStop=/etc/rc.d/init.d/network stop (code=exited, status=0/SUCCESS)
  Process: 4551 ExecStart=/etc/rc.d/init.d/network start (code=exited, status=0/SUCCESS)
    Tasks: 0

Why it's set exited? also there is preset:disabled can cause problem? Here is the ethernet connection config:

DEVICE=ens18
TYPE=Ethernet
ONBOOT=yes
NM_CONTROLLED=yes
BOOTPROTO=none
HWADDR=<hw mac address hidden>
IPADDR=<server ip hidden>
NETMASK=255.255.255.192
GATEWAY=<gateway ip hidden>
DNS1=<dns ip hidden>
DNS2=<dns ip hidden>
DEFROUTE=yes
IPV4_FAILURE_FATAL=yes
IPV6INIT=no
NAME=ens18

SSH Client Logs:

$ ssh root@<server ip> -v
OpenSSH_7.7p1, OpenSSL 1.0.2p  14 Aug 2018
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to <server ip> [<server ip>] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /c/Users/serhat/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /c/Users/serhat/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /c/Users/serhat/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /c/Users/serhat/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /c/Users/serhat/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /c/Users/serhat/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /c/Users/serhat/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /c/Users/serhat/.ssh/id_ed25519-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /c/Users/serhat/.ssh/id_xmss type -1
debug1: key_load_public: No such file or directory
debug1: identity file /c/Users/serhat/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.7
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to <server ip>:22 as 'root'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:MiFljnjU0tNBZzpOa2tl5oean+77W4wZ1/cy8f2ULeU
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:MiFljnjU0tNBZzpOa2tl5oean+77W4wZ1/cy8f2ULeU.
Please contact your system administrator.
Add correct host key in /c/Users/serhat/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /c/Users/serhat/.ssh/known_hosts:3
ECDSA host key for <server ip> has changed and you have requested strict checking.
Host key verification failed.
8
  • Looks like routing problem. This line NETMASK=255.255.255.192 suspicious. I think you can see the server sometimes via layer 2 according to arp tables, and sometimes not....
    – K-att-
    Feb 17 at 8:51
  • How long is that short time? Do you have any traffic on SSH during that time? Probably not in your case, but KeepAlive option in ssh could be the answer. Some firewalls close connections, if there is no traffic.
    – nobody
    Feb 17 at 8:56
  • You're not being clear. You are stating that after some time the connection closes and pinging from the server means you can then reconnect. What you have not said is what happens when you try are reconnect after the initial close and before you try the server ping.
    – Bib
    Feb 17 at 11:03
  • It's almost immediately after closes the connection. This is a virtual machine on Proxmox. I created network as bridged. There is also another vm server working normally; I can connect that via ssh. I mean I can ping anywhere from the server to test the server connectivity. Feb 17 at 11:13
  • @K-att, nothing suspicious about tthe netmask at all. I am guessing he has a small public range. I've got a couple, /28 & /29 (255.255.255.240 & 255.255.255.248). That .192 suggests he has a /26
    – Bib
    Feb 17 at 11:26

1 Answer 1

0

On SSH the server may close a connection after a certain period of inactivity (no communication between client and server). You can approach this behaviour via a client setting or a server setting.

On the client side edit the file ~/.ssh/config (create it if it doesn't exist):

Host *
    ServerAliveInterval 240

ServerAliveInterval specifies the client to send a signal to the server after an amount of seconds.

If you have access to the server you can modify the file /etc/ssh/sshd_config:

ClientAliveInterval 300
ClientAliveCountMax 10

This will cause the server to send a signal to the client every 5 minutes of inactivity. It does it 10 times before it closes the connection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.