SSH not working locally but is working externally after running nmap - ssh

I need to be able to SSH into a device on my network. Normally I am able to simply ssh into its local IP address.
I recently ran an nmap scan on it, and now when I try to ssh into its local IP address, I recieve the following:
kex_exchange_identification: read: Connection reset by peer
Connection reset by <IP> port 22
This network is setup in a somewhat unique way. It has one router that manages the Wi-Fi network (what my machine is connected to) which is connected to another box that also acts as the modem. IP addresses that are connected to the Wi-Fi box start with 192.168, whereas those connected to the modem box start with 10.0. The device I am trying to access is connected to the modem box.
Historically, just typing in its 10.0. local address has allowed me to ssh into it with no issue, even though my device is on the 192.168 network, and arp -a does not show it.
Checking the ssh logs of the device via journalctl -fu ssh, I can see that every failed ssh attempt is accompanied by the following message:
Connection reset by 10.0.0.96 port 49949 [preauth]
I do not recognize the IP above, and the port changes every time.
Is this some sort of anti-spam protection that was triggered by my use of nmap? I know it's not just my computer because I am unable to ssh into the device from anything else on my network.
Note that connecting to a VPN then using SSH to connect to the external IP address (which is port-forwarded properly) works, as does connecting via ssh to the machine from the machine itself (127.0.0.1)l
How can I fix this issue?

Related

SSH Connection to STM32MP1 Avenger96 board

I am trying to configure WiFi connection on my STM32MP157 based Avneger96 board. I have follows below steps to configure:
ifconfig eth0 down
ifconfig usb0 down
Start WiFi: ifconfig wlan0 up
iw dev wlan0 scan | grep ssid -i This lists my WiFi with proper SSID.
Since WiFi network uses WPA authentication I copy wpa_supplicant.conf file and pass the SSID and passphrase
cp /etc/wpa_supplicant.conf .
wpa_passphrase [SSID] [passphrase] >> ./wpa_supplicant.conf
SSID and passphrase is inserted without quotes and brackets and SSID doesn't contain any spaces.
Now connecting to WiFi network:
wpa_supplicant -B -Dnl80211 -iwlan0 -cwpa_supplicant.conf
iw dev wlan0 link : Its shows it's connected to WiFi. And ping google.com is successful.
Doing ifconfig shows the assigned IP Address on wlan0.
Now the problem is I am not able to access device using SSH. When I do ssh root#[IP Address], I get message that connection timed out.
ssh: connect to host [IP Address] port 22: Connection timed out
I am not able to resolve this. Can someone please let me know how to resolve this?
Your help will be much appreciated.
P.S: I am booting the board with custom Linux image built from Yocto Project. My host machine is Ubuntu 20.04. I have enabled required drivers in kernel config. And I have also included "packagegroup-base-wifi" in my image recipe and "wifi" in DISTRO_FEATURES_append. I have tried with different networks but still same error.
Edit
I tried to connect with LAN cable but IP address is not assigned in this case.

SSH Not Working with Cisco Integrated Services Router

I'm trying to ssh into my cisco ISR router. DHCP is working and I can ping the default gateway (the ISR), and can ssh with other devices on the LAN. so I know the LAN connection isn't the problem. I set up a local user that works with console logins so that's not the problem either.
I set up my ssh connection on the router with the following commands:
(config)#line vty 0 21
(config-line)#login local
(config-line)#exec-timeout 3
(config-line)#rotary 1
(config-line)#transport input ssh
(config)#crypto key generate rsa
(config)#ip ssh version 2
(config)#ip ssh port 2222 rotary 1
(config)#ip ssh authentication-retries 3
Then when I nmap the router it has the following ports open:
PORT STATE SERVICE
22/tcp open ssh
However, every time I try to log in to the router I get a Network is unreachable error. This is using the 2222 and 22 port and testing the normal IP and the hostname#ip formats for ssh and absolutely nothing works. I managed to get into telnet with the default settings earlier, but I'm not sure how to get in with SSH.
Thank you all for the help, I know it was very open ended so just let me know anything that could be helpful and I'll provide it.
One logical test step to do, would be switch back to port 22.
Network unreachable usually indicates there's no packet response coming from the host.
It could be because of multiple reasons, but since you've mentioned that ping and telnet went fine. I'd suggest you revert the port config, restart the unit once. See how it goes.
Other possible reasons could be ACL block and/or firewall block on your machine but I think it's unlikely.

I'm not able anymore to acces via ssh

For a project, I need to access the faculty server
Remotely through ssh after connecting the faculty VPN with my credentials.
Before,I log in quietly until recently with:
ssh my_name_user#147.163.26.244
it appeared to enter the password and entering the credentials I accessed the server (actually a virtual machine mounted on the server for me).
Now with the command above nothing happens and after waiting a bit I get:
ssh: connect to host 147.163.26.244 port 22: Connection timed out
What may have happened?
Yesterday I changed my password to access University services (mandatory after 3 months for security reasons). After doing so I had to change that new password in the VPN configurations and I was able to have access to the VPN and also to the server, until this all ok. From today at 13.00 this problem occurs.
Does anyone have any idea what this is all about?
(I'm on Ubuntu. The server(the virtual machine is a Lubuntu system))
Thanks for your attention.
Update:
The command
ping 147.163.26.244
gives me:
PING 147.163.26.244 (147.163.26.244) 56(84) bytes of data.
and
telnet 147.163.26.244 22
gives:
Trying 147.163.26.244...
and it remain running. What can I deduce?
As ssh shows connection timeout its nothing to do with your credentials. It hasn't go to the authentication level but failing before that itself.
First of all check if the IP is accessible from you machine using Ping (hoping ICMP should be allowed by the Firewall).
ping server_ip
If it shows not accessible- then make sure there is a route for the IP/IP subnet of the server IP through the vpn tunnel. You can do it by using route/netstat
example
netstat -nr | grep "147.163"
If route is not present you may have to add a route for this IP through the VPN tunnel. You can find the "route add.." or "ip route add ... " commands for this from google depending on your machine platform.
If the Ping shows the IP is pinging, we need to make sure the ssh service is running on the port 22. Just do a telnet and check
telnet <server_ip> 22
if the connection shows UP, in your case which shouldn't show UP btw :)as you got a timeout already. Then problem can be
(1) ssh service not running
(2) any firewall blocking your connection
You may have to get in touch with the ADMIN in that case.
===== Update =========
I guess your ping itself is failing.
Ping should show it is getting response.
example :
XXXXXXX$ ping 216.58.217.174
PING 216.58.217.174 (216.58.217.174): 56 data bytes
64 bytes from 216.58.217.174: icmp_seq=0 ttl=43 time=273.068 ms
64 bytes from 216.58.217.174: icmp_seq=1 ttl=43 time=317.405 ms
64 bytes from 216.58.217.174: icmp_seq=2 ttl=43 time=361.682 ms
64 bytes from 216.58.217.174: icmp_seq=3 ttl=43 time=266.436 ms
Check for the routes in your machine using route or netstat.
Possibilities :
server is down
Proper route is not present for the IP/subnet of the ssh server through VPN tunnel

Hook up Raspberry Pi via Ethernet to laptop without router? [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 3 years ago.
Improve this question
I'm working on a balloon project with a Raspberry Pi. When we potentially recover the Raspberry Pi, it will most likely be in a rural location and I'd like to turn off the Pi at that point safely.
Without a router or network nearby, I was wondering if there is a way to hook up a Raspberry Pi with an Ethernet cable directly to a laptop?
It's a solution for Ubuntu (the idea also works for Windows or Mac) I just tried today and it works like a charm.
Material
a cross-over Ethernet cable (the name is fancy but it's just a normal Ethernet cable)
a laptop (ubuntu)
a Raspberry Pi (I have the Pi2)
Prerequisites on your ubuntu
Install network-manager
$sudo apt-get install network-manager
Install nmap
$sudo apt-get install nmap
Edit Wired connection on your laptop (Ubuntu)
Change IpV4 settings to "Share to other computers"
Save the setting
Reboot your laptop
Share WiFi connection of your laptop via Ethernet crossover cable
Hook up your RPi with your laptop using the Ethernet cable
Look up the broadcast address of the Ethernet connection (Laptop),
$/sbin/ifconfig eth1 | grep "Bcast" | awk -F: '{print $3}' | awk '{print $1}' 10.42.0.255
Use this address to find out the IP address of your RPi, it's 10.42.0.96 in my case because 10.42.0.1 is my laptop
$nmap -n -sP 10.42.0.255/24
Starting Nmap 6.40 ( http://nmap.org ) at 2016-02-20 23:07 CET
Nmap scan report for 10.42.0.1
Host is up (0.00031s latency).
Nmap scan report for 10.42.0.96
Host is up (0.0023s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.71 seconds
Login to your RPi from your laptop (-Y with X-forwarding)
$ssh -Y pi#10.42.0.96
Lo and behold! Now your RPi is connected to your laptop and RPi can share the WiFi connection.
pi#raspberrypi ~ $
Share display & keyboard of your laptop with RPi
Install vncserver on Raspberry Pi
$ sudo apt-get update
$ sudo apt-get install tightvncserver
Install vncviewer on your laptop by downloading RealVNC (it supports multiple platforms)
http://www.realvnc.com/download/vnc/
To be able to copy & paste from VNC server <--> VNC viewer, you need to install autocutsel on your RPi.
$sudo apt-get install autocutsel
If this site doesn't work, try to download the .deb directly from a mirror site, e.g.
mirror.hmc.edu/debian/pool/main/a/autocutsel/autocutsel_0.10.0-1_armhf.deb
and install it
$sudo dpkg -i autocutsel_0.10.0-1_armhf.deb
Start vncserver on your RPi (You have to restart vncserver after installing autocutsel, you can issue $vncserver -kill :1)
$vncserver :1
Add autocutsel -fork to /home/pi/.vnc/xstartup
#!/bin/sh
xrdb $HOME/.Xresources xsetroot -solid grey
autocutsel -fork
#x-terminal-emulator -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" &
#x-window-manager &
# Fix to make GNOME work
export XKL_XMODMAP_DISABLE=1
/etc/X11/Xsession
Start vncviewer on your laptop
$vncviewer
A vncviewer window will pop up and type in the IP address of your RPi (given by your laptop) followed by port 1, which is your VNC server. for example: 10.42.0.96:1 in my case.
Connect it to the vncserver hosted on your RPi by typing in a password (set up a password yourself)
12.Now you can see the desktop of RPi on your laptop, and I opened my browser to show the shared WiFi connection is working as well.
See Raspberry Pi desktop on your ubuntu
No router + no screen + regular Ethernet cable + RPI 2 + Raspbian Lite 2018-11-13 + Ubuntu 18.10
First we must enable the SSH server on the Pi, which is disabled by default for security.
If you already have a shell on the Pi through a non-SSH method such as screen + keyboard or UART (see below), just run:
sudo systemctl enable ssh
sudo service sshd start
as explained at: https://raspberrypi.stackexchange.com/questions/58478/ssh-not-working-with-fresh-install This persists across boots.
Otherwise, insert he SD card on your host, and create a magic empty file named ssh file in the boot/ partition.
On Ubuntu hosts, it gets mounted automatically and you can do just:
sudo touch /media/$USER/boot/ssh
which you can confirm with:
lsblk
which contains:
mmcblk0 179:0 0 14.4G 0 disk
├─mmcblk0p1 179:1 0 43.9M 0 part /media/ciro/boot
└─mmcblk0p2 179:2 0 14.4G 0 part /media/ciro/rootfs
If you don't enable the SSHD daemon on the Pi then SSH connection will fail with:
ssh: connect to host 10.42.0.160 port 22: Connection refused
when we try it later on.
After enabling the SSH server
Next, boot the Pi, and link an Ethernet cable from your laptop directly to the Pi:
On Ubuntu 17.04 to work around this bug as mentioned on this answer you first need:
sudo apt-get install dnsmasq-base
On the host, open the network manager:
nm-connection-editor
And go:
+ sign (Add a new connection)
Ethernet
Create
IPv4 Settings
Method: Shared to other computers
Set a good name for it
Save
Find the IP of the Pi on host:
cat /var/lib/misc/dnsmasq.leases
outputs something like:
1532204957 b8:27:eb:0c:1f:69 10.42.0.160 raspberrypi 01:b8:27:eb:0c:1f:69
10.42.0.160 is the IP, then as usual:
ssh pi#10.42.0.160
I also have the following in my .bashrc:
piip() ( cat /var/lib/misc/dnsmasq.leases | cut -d ' ' -f 3; )
pissh() ( sshpass -p raspberry ssh "pi#$(piip)"; )
From inside the Pi, notice that it can access the internet normally through your host's other interfaces:
ping google.com
For example on my laptop, the Pi takes up the Ethernet, but the host is also connected to the internet through WiFi.
The crossover cable is not required if the host network card supports Auto MDI-X. This is the case for most recent hardware, including for example the 2012 Lenovo T430 I tested with, which has an "Intel® 82579LM Gigabit Network Connection" which documents support for Auto MDI-X.
Now you can also:
access the Internet from the PI through your Ubuntu's Wifi connection
open a VNC to get rid of the display as well: https://raspberrypi.stackexchange.com/questions/14611/how-to-set-up-raspberry-pi-without-a-monitor/54393#54393
UART serial USB converter
This is an alternative to SSH if you just want to get a shell on the Pi: https://en.wikipedia.org/wiki/Serial_port
This does not use SSH or networking itself, but rather the older, simpler, more direct, more reliable, lower bandwidth, lower distance serial interface. The Pi won't have access to the Internet with this method.
Desktop computers still have a serial port which you can connect directly wire to wire with the Pi, but these are hidden in most laptops, and so we need to buy a cheap USB adapter. Here I've used a "DSD TECH USB to TTL Serial Converter" https://www.amazon.co.uk/gp/product/B072K3Z3TL See also: https://unix.stackexchange.com/questions/307390/what-is-the-difference-between-ttys0-ttyusb0-and-ttyama0-in-linux/367882#367882
First plug the SD card on the host, and edit the config.txt file present in the first partition to add:
enable_uart=1
as explained at: https://www.raspberrypi.org/forums/viewtopic.php?f=28&t=141195
This first partition contains the bootloader, its configuration files and the (Linux / your) kernel, config.txt being one of them. The second partition contains the actual Linux root filesystem.
Now connect your computer to the Pi as:
You only need to attach 3 cables:
Ground to Ground
Tx on Pi to Rx on the USB to serial port
Rx on Pi to Tx on tye USB to serial port
This is also documented at: https://www.raspberrypi.org/documentation/usage/gpio/README.md
Be careful not to link the Ground to the 5V, I've already burned 2 UART to USB chips and a RPI UART by doing that!
You don't need to connect the 5V to the 5V at all. I think you can power your Pi like that, but I've read that this is a bad idea, just use the usual USB power source.
Finally, plug the USB side of the connector to your host computer, and get a shell with:
sudo apt install screen
sudo usermod -a -G dialout $USER
screen /dev/ttyUSB0 115200
Exit with Ctrl-A \.
Here is a video by Adafruit showing it: https://www.youtube.com/watch?v=zUBPeoLW16Q
See also
Similar question on RPI SE: https://raspberrypi.stackexchange.com/questions/3867/ssh-to-rpi-without-a-network-connection
You don't need a cross-over cable. You can use a normal network cable since the Raspberry Pi LAN chip is smart enough to reconfigure itself for direct network connections.
Cheers
I've just implemented and test this successfully. Same situation with my project, want to connect to a Raspberry Pi with no router or wifi. Just a simple ethernet cable.
Using ssh putty program put the address as
raspberrypi.local
Log and in and you can access the terminal.
Alternatively if VNC server is setup, use VNC server and put
raspberrypi.local:1
In the server address. input your VNC server password and you've now got GUI access to do what you want.
In may case it was run scripts in a remote location. In the posters situation, safely shutdown the Pi. Simples Pimples.
Configure static ip for your laptop and raspberry pi.
On the rapberryPI configure it as following.
pi#rpi>sudo nano /etc/network/interfaces
Then configure following as required to connect to your laptop.
iface eth0 inet static
address 192.168.1.81
netmask 255.255.255.0
broadcast 192.168.1.255
configure static ip on the raspberry pi:
sudo nano /etc/network/interfaces
and then add:
iface eth0 inet static
address 169.254.0.2
netmask 255.255.255.0
broadcast 169.254.0.255
then you can acces your raspberry via ssh
ssh pi#169.254.0.2
Here are the instructions for Windows users on connecting to a RPi by using just an Ethernet cable and a DHCP server. There is no need for a cross over cable, as the RPi can handle it. I have a blog post that documents this with pictures here which may be easier to follow.
Downloads
Download the DHCP Server for Windows (download link is here). Unzip the zip file and open the dhcpwiz application, which will configure the DHCP server.
DHCP Server Configuration
Hit next on the first screen.
On the second screen, look for a "Local Area Connection" row and verify its IP address is 0.0.0.0 and its status is enabled. Connect the Ethernet cable from the RPi to your laptop, and turn on the Pi. Hit refresh on this screen until the IP address changes to 169.254.*.*. If it is anything else then you should alter your network settings for the Local Area Connection (make sure it is not a static IP/DNS). Click on this Local Area Connection row and hit next.
Check HTTP (Web Server). This makes it much more easy to locate the RPi's IP address. Hit Next.
Take the defaults and hit Next until you get to the Writing the INI file screen. Check Overwrite existing file and hit the Write INI file button. Then hit Next.
On the final screen, check Run DHCP server immediately and hit `Finish.
DHCP Server and Obtaining the IP Address of your Raspberry PI
This launches the actual DHCP server, using the configuration you just created in the previous wizard. Click the Continue as tray app button, and the DHCP server will be minimized to your system tray.
Anywhere from 1 second to 5 minutes from now you will see an alert on the system tray with your laptop and your RPi's new IP address. This alert is really quick and you will probably miss it. Normally your RPi's IP is 169.254.0.2, but it could be *.01 or even something else. It is easier to access the DHCP server's web UI at http://localhost/dhcpstatus.xml. This will list the hostname as "raspberrypi" with its IP address.
Now you can putty or remote desktop into your RPi, and configure its wireless settings or whatever you want to do.
Trouble shooting
This can be somewhat finicky. I've had my connection appear to drop and have been unable to SSH back in using the IP address. Normally, I can restart the Pi and get the IP address again. Sometimes I have to restart both the RPi and the DHCP server. Sometimes I have to do this multiple times. At one point when I wasn't getting a connection for 15 minutes, I copied all of the files in the dhcpsrv2.5.1 folder to a new folder and tried again; it immediately worked.
You could use a cross-over ethernet cable - http://en.wikipedia.org/wiki/Ethernet_crossover_cable
Assuming your RPi is a DCHP Client, then best to run a simple DHCP server on your notebook to assign the RPi an IP address.
Yes, you can connect the raspberry direct to your PC without router.
For this is necessary that the raspberry and your computer are on the same subnet, and they both have a static ip configured (And an Ethernet cable connected between the two devices).
An ideal configuration would be the following:
Raspberry on eth0: IP: 192.168.1.10 SubNet: 255.255.255.0
Your PC: IP: 192.168.1.11 SubNet 255.255.255.0
To set a manual IP on raspberry you can follow this guide
In your PC you can set a manual IP in the network adapter settings,and the procedure depends on your operating system.
When you have configured the two static IP, you can connect to the raspberry via SSH using the IP set (192.168.1.10).
Another simpler method is to attach on GPIO a button to turn off the raspberry! Take a look here!
What worked for me was a combination of the answers from Nicole Finnie and Ciro Santilli along with some answers from elsewhere.
Setting up the pi
We will need to do two things: activate ssh on the pi, and configure the pi to use a static ip.
Activating ssh
Add a file called ssh in the boot partition of the sd card (not the /boot folder in the root partition). This is well documented other places.
Static ip
Open /etc/dhcpcd.conf on the pi's SD-card, and uncomment the example for a static ip (starts around line 40). Set the addresses to
# Example static IP configuration:
interface eth0
static ip_address=10.42.0.182/24
static routers=10.42.0.1
static domain_name_servers=10.42.0.1 8.8.8.8 fd51:42f8:caae:d92e::1
Setting up your laptop
First, make sure you have networkmanager (with GUI) installed on your laptop. Then, make sure dnsmasq is not running as a service:
systemctl status dnsmasq
If this command prints that the service is stopped, then you're good.
Next we have to config networkmanager. Open /etc/NetworkManager/NetworkManager.conf and add the following two lines at the top:
[main]
DNS=dnsmasq
Then reboot. This step might not be necessary. It might be sufficient to restart the NetworkManager service. Now go to the NetworkManager GUI (usually accessed by an icon in the corner of the screen) and choose Edit Connections... In the window that pops up, click the + icon to create a new connection. Choose Ethernet as the type and press Create.... Go to the IPv4 Settings tab and select the method Shared to other computers. Give the connection a good name and save.
Connect the Raspberry Pi and make sure your laptop is using your new connection as its ethernet connection. If it is, your pi should now have an ip given to it by your pc. You can find this by first running ifconfig. This should give you several blocks of text, one for each network interface. You're interested in the one that is something like enp0s25 or eth0. It should have a line that reads something similar to
inet 10.42.0.1 netmask 255.255.255.0 broadcast 10.42.0.255
look at the broadcast address (in this case 10.42.0.255). If it is different than mine, power off the pi and put the SD card back in your laptop to change the static ip_address to something where the first three numbers are the same as in your broadcast address. Also change the static routers and the first of the domain_name_servers to your laptop's inet address. Power the pi back on and connect it. Run ifconfig again to see that the addresses have not changed.
ssh into the pi
ssh pi#10.42.0.182
If you get connection refused, the pi isn't running an ssh server. If you get host unreachable, I'm sorry.
Hope this helps someone!

ssh to a qemu virtual machine guest without typing in the password

Now I want to run a script from a client machine which will ssh to a virtual machine guest on a host machine and start to run a shell command. I do not want to be prompted to input the password.
So firstly I try to do it to connect to the host. I copy the file id_rsa.pub in the .ssh folder from the client to the host's file called authorized_keys in the .ssh folder. Then when I
"ssh root#hostname"
It works fine and I do not need to input the password(note my client's account is not root).
Then I try the same thing to the virtual machine guest in the host. I copied the same file to the guest. I started the guest using qemu with option "-net user,vlan=0,hostfwd=tcp::5555-:22 " which will forward the requests to host 5555 port to guest's 22 port. Then in the client, I executed
" ssh -p 5555 root#hostname "
It fails. It shows that RSA key for the host has changed or something... Note that my guest's account is also root and I can use Putty to ssh to the guest by connecting to the 5555 port of the host. And I believe the file permission is also properly handled.
Does anyone have a clue :>
Yes, this is correct behavior.
When you get connected to the host system first time, the ssh at your client machine ask you if the machine with fingerprint bla-bla-bla really the one you are wanted to connect. You replied 'yes' and ssh at your client machine memorized the host name, IP and the fingerprint in the file ~/.ssh/known_hosts. Then during all subsequent connections it verifies that the fingerprint is not changed as a change is an indication that the authentication process requires your attention. There could be a few valid reasons of a mismatch:
you re-installed sshd at the remote host;
your host uses DHCP to get its IP and the IP got changed.
The case when you know precisely that the fingerprint should not change indicates to you an attempt to make you get into another system.
This mechanism aimed to make you sure that you are logged in to the system you are expected to log in.
In your case you first log into the system at IP a.b.c.d at port 22. Then you try to log in with the same IP a.b.c.d at port 5555. There is your VM behind this port that is having different fingerprint. So ssh complains.
The solution for your problem will be to log in to the host system and then from this remote shell session into VM. Also I would recommend you to generate another pair of public/private keys for this 'remote' connection. Thus when your private key kept at the host get compromised then your private key that is kept at your workstation remains valid.