I've installed ansible on my master vm, created and copied my key to my worker vm, but I'm unable to establish connection with the worker vm. When I try, I don't get any error message; it just stalls. I'm using ubuntu 18 on gcp.
root#mastervm-project:~# ssh ubuntu#10.128.0.11
There is no firewall rule that allows ingress on 22 on your target instance.
I just reproduced. This will do the job:
Step 1:
Add a network tag on your VMs (allow-ssh in my example)
Step 2:
Go to VPC-FirewallRules and create a firewall rule that allows Ingress traffic incoming from instances that have the allow-ssh tag targeting other instances that have the same tag assigned, on tcp 22
Of course this will allow ssh both ways, but I suppose this is not a problem. If you need it one way only, add a comment.
For SSH Database connection, Please check following solution:
Create SSH DB general connection and call it from some other file
I just restarted my google cloud compute engine instance and now I cannot SSH login to it. Before restarting, it worked fine. I tried fully stopping it and then starting again. There was a webserver on it and if I try to access any API method, I get timeout.
If I try to login from console website:
If I try to login from terminal:
ssh: connect to host 104.197.20.65 port 22: Operation timed out
ERROR: (gcloud.compute.ssh) [/usr/bin/ssh] exited with return code [255]. See https://cloud.google.com/compute/docs/troubleshooting#ssherrors for troubleshooting hints.
What is wrong?
As the error message suggest the first thing to do is check the firewall rules. There must be a rule allowing connections from any ip (0.0.0.0/0) through the port 22. I assume that your instance's ssh was working before, so it can be two things.
The rule is being applied to a certain network, and the network configuration of the VM was changed when it was shutted down.
The rule is not being applied to the VM, maybe it is in a subnetwork, closing the communication.
To simplify the solution:
A- Add a network tag to your VM. (Ex. ssh-conn)
https://cloud.google.com/compute/docs/vpc/add-remove-network-tags
B- Create a rule to allow connections from any ip and apply it to the network tag previously created.
https://cloud.google.com/compute/docs/vpc/using-firewalls
I had the same problem, and tried lots of way but none of them work.
But the way below is work for me:
Connect to instance by serial console.
vi /etc/ssh/sshd_config, delete the hash tag before Port 22, like this:
Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
Hope it work for you too.
When I am working at the University, the program I use for managing papers (Papers2, from mekentosj), connects to the EZproxy, so that it can download papers.
When I am at home, I can't do this. My question is can I somehow setup an SSH tunnel to the University so that the program Papers can log into the EZproxy from home?.
P.S. As a follow-up to comments, I have the right to set up an SSH tunnel at our University, on my Linux machine.
Since you stated that you have SSH access to your university, you can use Dynamic Port Forwarding:
ssh -D LOCAL_PORT USER#UNIVERSITY_MACHINE_IP allows you to forward each connection through the LOCAL_PORT you specified on your machine.
Go your OS's connection settings
Check Manual Proxy Settings
Enter 127.0.0.1 in the SOCKS field.
Enter LOCAL_PORT you choose to Port field.
Now, every connection protocol (HTTP, FTP, etc.) will be forwarded through the university machine you connected.
Note:
Be sure to select an unused port on your computer bigger than 1024 as LOCAL_PORT
You can only do this while your SSH connection is still alive.
You can also configure browser-only forwarding from the settings of your browser of choice.
Still not enough information to create a pre-fabricated solution for you. Anyway, a few resources:
How to set Papers library proxy: I do not know if you can create your own proxy, e.g. on localhost:2048, tunnelling through to the university.
How many (and which) proxy ports does EZproxy use? This should help you determine the SSH tunnel settings you need for your connection
Your university's EZproxy administrator: Ask her if she can tell you how to set up remote access. Maybe there is an official way to set this up, possibly an already existing, externally accessible proxy URL or SSH hopping station, maybe a VPN or whatever.
Although I use some alias to do ssh tunnel or reverse tunnel, I never understand how it works. Does somebody know how to explain it in very simple way?
I think the 3 primary uses are:
First of all, I can use my home computer to ssh to foo.mycompany.com, without using any password
(foo is a server at work)
How to make foo.mycompany.com:8080 go to my home computer's localhost:3000 ?
If at home, I cannot access http://bar.mycompany.com, but foo can access bar, how to make the home computer able to access http://bar.mycompany.com?
If at home, I cannot access MySQL db at db.mycompany.com, but foo can, how to make it possible to access db.mycompany.com also using ssh tunnel.
Can it be explain in very simple terms? Are there actually some other popular use besides these 3? thanks.
1) Assuming you connect from home to foo, you need a reverse tunnel (-R)
ssh -R 8080:localhost:3000 foo.mycompany.com
This will enable processes running at foo to connect to localhost:8080 and actually speak to your home computer at port 3000. If you want other computers at your work to be able to connect to foo:8080 and access your home computer at port 3000, then you need
ssh -R 0.0.0.0:8080:localhost:3000 foo.mycompany.com
but for this to work you also need this option to foo's sshd_config
GatewayPorts yes
2) The best way to create an http proxy with ssh is with socks. First connect with
ssh -D 8888 foo.company.com
then go to your browser connection settings and enable proxy connection, choose socks4/5 and host: localhost, port 8888. Then just type http://bar.mycompany.com in your browser's address bar.
3) Now you need a local port forward (-L).
ssh -L 3333:db.mycompany.com:3306 foo.mycompany.com
This means that you will be able to connect at localhost:3333 from your home computer and everything will be forwarded to db.mycompany.com:3306 as if the connection was made by foo.mycompany.com. Host db will see foo as the client connecting, so you need to login with the same username and password you use when working from foo.
Adding -g flag will enable other computers from your home network to connect to your computer port 3333 and actually access db:3306.
SSH tunnelling is very simple. It opens a listening socket at one end. Whenever anyone connects to that listening socket, it opens a corresponding connection from the other end to the configured location, then forwards all information both ways between the two, over the SSH link.
Quite an old question, but see if this page helps explain it for you, it's got pretty pictures and all. :)
https://www.ssh.com/ssh/tunneling/
Basically, a SSH Tunnel is a tunnel that can be used to pass (tunnel) data from one place to another, encrypted.
It is also commonly used to route traffic (via a tunnel, think wormhole) to somewhere else, which allows for things such as tunnelling through a firewall or redirecting traffic (encrypted port forwarding).
Let's say you have a firewall between you and the server. The server can access another server (server2) on it's internal network.
[client]--------||------[server]----[sever2]
Let's say you want to access a web server on server2, and for obvious reasons you can't do this directly. Let's say that port 22 (ssh) is open on the firewall. So what we would do is create an SSH tunnel (on server) from server to server2. This will mean that any (outbound?) traffic on port 22 will be sent, via this tunnel, from server:22 -> server2:80.
[client]--------||------[server:22]======[sever2:80]
So (as I understand it), if we connect to server:22, it should redirect traffic on port 22 to the web server on server2:80 using this new SSH tunnel. (as far as I understand, the data is only encrypted in the tunnel, so the end will be decrypted data, if you're wondering if server:80 has to be SSL).
I suppose in one way that using SSH, is in itself, an SSH Tunnel for your old telnet communication. It's just that in most times you hear about SSH Tunnelling, people are referring to the (secure) port forwarding feature it offers, without having to have access to the firewall admin, which is a nifty little feature that a lot of hackers like to use to get around security.
On the more legitimate reasons; it's great way to relay certain traffic to an internal server that works on a different port, should you be limited by a firewall and such, or you want to secure the traffic between two machines (like the SSH program does).
Hope this helps.
EDIT
Found this over at the UNIX SO https://unix.stackexchange.com/questions/46235/how-does-reverse-ssh-tunneling-work, lots of answers with very clear (and pictorial) explanations of what you need!
First of all I will explain SSH:
SSH is remote login shell that helps you to connect remote machines using encrypted connection. So once you made ssh connection to any remote host the connection between hosts are secure and encrypted.
SSH tunneling is routing your traffic through SSH secure connection.
In simple words SSH tunneling is nothing but one connection is encapsulated by another connection. By taking this as a advantage we make tunnels by using SSH client.
Following command helps you to create simple socks proxy
ssh -D 8080 user#sshserverip
Read the man page, specifically the -L, -R and -D options. I don't think someone rewriting this, and possibly introducing mistakes, is useful. If you don't understand it though you could ask more specific questions.
-D gives a SOCKS proxy, which is another useful application of ssh tunnelling.
I cannot SSH into my instance - Operation timed out. What could be the reasons why, and what can I do to resolve it? Rebooting normally takes a long time to take effect, and might just makes things worst
UPDATE: It is not about permissions - i can log in normally just fine. I suspect it might be because of memory issues
I had the same problem, and the solution ended up being adding my
local machine's IP to the list of inbound rules in the active security
group. In the inbound dialog below, enter 22 in the port range, your local IP/32 in the source field, and leave 'custom tcp rule' in the dropdown.
Did you set an appropriate security group for the instance? I.e. one that allows access from your network to port 22 on the instance. (By default all traffic is disallowed.)
Update: Ok, not a security group issue. But does the problem persist if you launch up another instance from the same AMI and try to access that? Maybe this particular EC2 instance just randomly failed somehow – it is only matter of time that something like that happens. (Recommended reading: Architecting for the Cloud: Best Practices (PDF), a paper by Jinesh Varia who is a web services evangelist at Amazon. See especially the section titled "Design for failure and nothing will fail".)
Destroy and create anew
I had one availability zone where I could connect and another where I could not. After a few hours I got so frustrated that I deleted everything in that availability zone.
Building everything back I had to make sure to create EVERYTHING. This included:
Create VPC
CIDR: 10.0.0.0/24
Create Internet Gateway
Attach Internet Gateway to VPC
Create Routing Table
Add Route to Routing Table
Destination: 0.0.0.0/0
Target: <Internet Gateway from earlier>
Create Subnet
CIDR: 10.0.0.0/24
Routing Table: <Routing Table from earlier
It took me a LOT of fumbling to get all of this. I've ordered the steps in the way I think might be most efficient, but you may have to adjust them to get one item available for the next.
Suggestion
I'm not suggesting that you go thermo nuclear as I did. I'm offering all this information so that you can check these associations to ensure yours are appropriate.
This answer is for the silly folks (like me). Your EC2's public DNS might (will) change when it's restarted. If you don't realize this and attempt to SSH into your old public DNS, the connection will stall and time out. This may lead you to assume something is wrong with your EC2 or security group or... Nope, just SSH into the new DNS. And update your ~/.ssh/config file if you have to!
To connect use ssh like so:
ssh -i keyname.pem username#xxx.xx.xxx.xx
Where keyname.pem is the name of your private key, username is the correct username for your os distribution, and xxx.xx.xxx.xx is the public ip address.
When it times out or fails, check the following:
Security Group
Make sure to have an inbound rule for tcp port 22 and either all ips or your ip. You can find the security group through the ec2 menu, in the instance options.
Routing Table
For a new subnet in a vpc, you need to change to a routing table that points 0.0.0.0/0 to internet gateway target. When you create the subnet in your vpc, by default it assigns the default routing table, which probably does not accept incoming traffic from the internet. You can edit the routing table options in the vpc menu and then subnets.
Elastic IP
For an instance in a vpc, you need to assign a public elastic ip address, and associate it with the instance. The private ip address can't be accessed from the outside. You can get an elastic ip in the ec2 menu (not instance menu).
Username
Make sure you're using the correct username. It should be one of ec2-user or root or ubuntu. Try them all if necessary.
Private Key
Make sure you're using the correct private key (the one you download or choose when launching the instance). Seems obvious, but copy paste got me twice.
Have you looked at the console output from the instance ? You can do this via the AWS console (Instances -> Right-click on the instance -> Get System Log). I've had occasions where the network services on an EC2 instance failed to start correctly, resulting in timed out SSH connections; restarting the instance usually fixed things.
AFTER 2 HOURS I FOUND THIS
Note That ssh ip 120.138.105.251/32
IS NOT aws instance IP ADDRESS
It Is not your local ip 127.0.0.1
It Is not your local ip localhost
BUT BUT BUT
Its Your public ip address of your personal Computer from which you trying to access aws instance
Go to https://www.whatismyip.com/ whatever ip address put in ssh
IF YOU WANT TO FULLY OPEN SSH TO ALL IP ADDRESS
THIS IS HOW FULLY ACCESSIBLE ENTRIES LOOK - BASIC RECOMEENDED
THIS IS WHAT I AM USING IN PRODUCTION
The following are possible issues:
The most likely one is that the Security Group is not configured properly to provide SSH access on port 22 to your i.p. Change in security setting does not require a restart of server for it to be effective but need to wait a few minutes for it to be applicable.
The local firewall configuration does not allow SSH access to the server. ( you can try a different internet connection, your phone/dongle to try it)
The server is not started properly ( then the access checks will fail even on the amazon console), in which case you would need to stop and start the server.
Allow ssh and port 22 from ufw, then enable it and check with status command
sudo ufw allow ssh
sudo ufw allow 22
sudo ufw enable
sudo ufw status
Check out this help page on AWS docs:
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesConnecting.html#TroubleshootingInstancesConnectionTimeout
You will probably find your solution there. for me this part did the fix:
[EC2-VPC] Check the route table for the subnet. You need a route that
sends all traffic destined outside the VPC to the Internet gateway for
the VPC.
Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
In the navigation pane, choose Internet Gateways. Verify that there is an Internet gateway attached to your VPC. Otherwise, choose Create
Internet Gateway and follow the directions to create an Internet
gateway, select the Internet gateway, and then choose Attach to VPC
and follow the directions to attach it to your VPC.
In the navigation pane, choose Subnets, and then select your subnet.
On the Route Table tab, verify that there is a route with 0.0.0.0/0 as the destination and the Internet gateway for your VPC as the
target. Otherwise, choose the ID of the route table (rtb-xxxxxxxx) to
navigate to the Routes tab for the route table, choose Edit, Add
another route, enter 0.0.0.0/0 in Destination, select your Internet
gateway from Target, and then choose Save.
But I suggest you check out all the options the link above covers , you may find there the one or more issues that you got.
My issue - I had port 22 open for "My IP" and changed the internet connection and IP address change caused. So had to change it back.
Building off #ted.strauss's answer, you can select SSH and MyIP from the drop down menu instead of navigating to a third party site.
Just reboot the Ec2 Instance once you applied Rules
I was working on the instance and it was fine, the very next day when I tried to SSH into my instance it said - Connection timeout.
I tried to go through this post but nothing worked. So I did -
On the Edit inbound rules from source column choose MY IP and it will automatically populate your Public IP address in CIDR format (XXX.XXX.XXX.XX/32).
I tried with the #ted.strauss answer by giving local IP but it did not help in my case. So I choose MY IP and it worked.
Hope this helps someone!
In my case, Instance was reachable but suddenly it became unreachable.
I just rebooted the instance from aws console & it solved my problem.
If you still have this problem today and non of the other solutions have been helpful, what worked for me was; go to security groups, select a security group or create one, then click to add new inbound rule, click the source drop down and select "from anywhere" this will set 0.0.0.0/0 as the source ip.
You should be fine now.
Ensure you already have the private key file on your machine.
you can watch this video if you need more clarity.
https://www.youtube.com/watch?v=8UqtMcX_kg0
One more possibility. AWS security groups are setup to work only with specific incoming ip addresses. If your security group is setup in this way you (or the account holder) will need to add your ip address to the security group. Todo this open your AWS dashboard, select security groups, select a security group and click on the inbound tab. Then add your ip as appropriate.
I had the same problem, and the solution was allowing access from anywhere to the list of inbound rules in the active security group. In the inbound dialog, enter 22 in the port range, anywhere in the source field, and select 'ssh' in the dropdown.
P.S : This might not be the recommended solution as it means this instance can be ssh'ed from any machine, but I could not get it to work with my local IP.
I had similar problem, when I was using public Wifi, which didn't have password. Switching the internet connection to a secure connection did solve the problem.
If SSH access doesn't work for your EC2 instance, you need to check:
Security Group for your instance is allowing Inbound SSH access (check: view rules).
If you're using VPC instance (you've VPC ID and Subnet ID attached to your instance), check:
In VPC Dashboard, find used Subnet ID which is attached to your VPC.
Check its attached Route table which should have 0.0.0.0/0 as Destination and your Internet Gateway as Target.
On Linux, you may also check route info in System Log in Networking of the instance, e.g.:
++++++++++++++++++++++++++++++++++++++Net device info+++++++++++++++++++++++++++++++++++++++
+--------+------+------------------------------+---------------+-------+-------------------+
| Device | Up | Address | Mask | Scope | Hw-Address |
+--------+------+------------------------------+---------------+-------+-------------------+
| lo | True | 127.0.0.1 | 255.0.0.0 | . | . |
| eth0 | True | 172.30.2.226 | 255.255.255.0 | . | 0a:70:f3:2f:82:23 |
+--------+------+------------------------------+---------------+-------+-------------------+
++++++++++++++++++++++++++++Route IPv4 info+++++++++++++++++++++++++++++
+-------+-------------+------------+---------------+-----------+-------+
| Route | Destination | Gateway | Genmask | Interface | Flags |
+-------+-------------+------------+---------------+-----------+-------+
| 0 | 0.0.0.0 | 172.30.2.1 | 0.0.0.0 | eth0 | UG |
| 1 | 10.0.3.0 | 0.0.0.0 | 255.255.255.0 | lxcbr0 | U |
| 2 | 172.30.2.0 | 0.0.0.0 | 255.255.255.0 | eth0 | U |
+-------+-------------+------------+---------------+-----------+-------+
where UG flags showing you your internet gateway.
For more details, check: Troubleshooting Connecting to Your Instance at Amazon docs.
To enable ssh access from the Internet for instances in a VPC subnet do the following:
Attach an Internet gateway to your VPC.
Ensure that your subnet's route table points to the Internet gateway.
Ensure that instances in your subnet have a globally unique IP address (public IPv4 address, Elastic IP address, or IPv6 address).
Ensure that your network access control (at VPC Level) and security group rules (at ec2 level) allow the relevant traffic to flow to and from your instance. Ensure your network Public IP address is enabled for both. By default, Network AcL allow all inbound and outbound traffic except explicitly configured otherwise
For me it was the apache server hosted on a t2.micro linux EC2 instance, not the EC2 instance itself.
I fixed it by doing:
sudo su
service httpd restart
I had the same problem and I solved it by adding a rule to the security Groups
Inbound SSH 0.0.0.0/0
Or you can add your IP address only
For me, it was that I had deleted everything from the boot volume. And couldn't connect to the instance anymore.
ping the DNS first . If fails then configure your inbound/outbound rules in the launch wizard . configure ALL traffic and ALL protocol and just save with default options . Ping again with your local system and then should work
If you've just created a new instance and can't connect to it, I was able to solve the issue by terminating that one and creating a new one. Of course this will only work if it's a new instance and you haven't done any more work on it.
There could be multiple reasons for connection getting timed-out during ssh. One of the cases where i have seen this is when your route and subnet does not have associations.
If you're trying to connect from another EC2 instance, you have to make sure to only use the PRIVATE IPv4 addresses to reference them or the connections will not work.
This will be one of the reason. when you enable ufw and reboot your instance. First you have to add 22/tcp before enabling ufw. Following is the command
$ ufw allow 22/tcp
If you already made the mistake. Then follow the following guide
Start a recovery instance.
Stop the blocked instance (DON'T TERMINATE)
Detach the blocked instance volume.
Attach Blocked volume to the recovery instance.
Log to the recovery instance(Newly Launched) via ssh/putty
Type sudo lsblk to display attached volumes
Verify the name of the Blocked volume. Generally start with /dev/xvdf.
Mount blocked volume.
$ sudo mount /dev/xvdf1 /mnt
$ cd /mnt/etc/ufw
Open ufw configuration file
$ sudo vi ufw.conf
Enable insert mode by pressing i in vi editor
Update ENABLED=yes to ENABLED=no
ClickESC and type :wq to update the file.
Verify the file contents. where update to ENABLED=yes -> ENABLED=no
$ sudo cat ufw.conf
Remove the mounted blocked volume from recovery instance
$ cd ~
$ sudo umount /mnt
Now detach blocked install volume from recovery instance and re-attach it to the original instance as /dev/sda1.
Finally, Start the blocked instance. Here's you will able to access your instance. If you enable ufw again don't forget to allow 22/tcp.
sudo ufw allow ssh //this one are to be added
sudo ufw allow 22 // this one
sudo ufw enable
sudo ufw status
The solution with me was different than all the above solutions. I forgot the my VPN on. When I turned it off the problem is solved.