0

I've come across bunch of documentation on google/stack on this issue. but didn't find any solution

I've a raspberry pi ssh server in my LAN that I want to ssh from internet (Outside the LAN).

I can ssh it locally (LAN), but if ssh using public ip/open port (either from inside LAN / from my office) it refuses connection.
my network topology- 

ISP ______(ethernet)> tpLink Router (port forwarded) --------- > raspberry pi (wifi connected with static ip)

I've scanned my public ip,as the port 22 is closed, and found the open ports

PORT STATE SERVICE
179/tcp open bgp
2000/tcp open cisco-sccp
8291/tcp open unknown

so I choose port 8291 and 8000 and port forwarded it from the tplink router to the static ip of the raspberry ssh server. I can easily ssh into the ssh server locally with password. but when ssh with my public ip (from LAN/Outside LAN using putty)

ssh -v pi@public.ip -p 8291 or pi@public.ip port 8291

it gets stuck on ": Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2" and after one or two minutes it gives "ssh_exchange_identification: Connection closed by remote host" other open ports give the same result but faster. (details)

ssh -v pi@public.ip -p 8291
OpenSSH_7.2p2 Ubuntu-4ubuntu2.2, OpenSSL 1.0.2g  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to public.ip [public.ip] port 8291.
debug1: Connection established. # that does mean connection established once
debug1: identity file /home/ph03n1x/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ph03n1x/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ph03n1x/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ph03n1x/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ph03n1x/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ph03n1x/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ph03n1x/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ph03n1x/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 # gets stuck at this stage even with -vvv no debug messgage and ends with following
ssh_exchange_identification: Connection closed by remote host

I've checked my server auth.log that seems have no trace of listing the logging attempt. here are some useful details of my network netstat -tupan:

sudo netstat -tupan
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:8291            0.0.0.0:*               LISTEN      1094/sshd       
tcp        0      0 0.0.0.0:8000            0.0.0.0:*               LISTEN      1094/sshd       
tcp        0     92 192.168.0.117:8291                                          ESTABLISHED 939/sshd: pi [priv]
udp        0      0 0.0.0.0:68              0.0.0.0:*                           394/dhcpcd      
udp        0      0 192.168.0.101:123       0.0.0.0:*                           515/ntpd        
udp        0      0 192.168.0.117:123       0.0.0.0:*                           515/ntpd    # raspberry pi with static ip    
udp        0      0 127.0.0.1:123           0.0.0.0:*                           515/ntpd        
udp        0      0 0.0.0.0:123             0.0.0.0:*                           515/ntpd        
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           378/avahi-daemon: r
udp        0      0 0.0.0.0:48445           0.0.0.0:*                           378/avahi-daemon: r
udp6       0      0 fe80::1c85:89ee:956:123 :::*                                515/ntpd        
udp6       0      0 ::1:123                 :::*                                515/ntpd        
udp6       0      0 :::123                  :::*                                515/ntpd        
udp6       0      0 :::5353                 :::*                                378/avahi-daemon: r
udp6       0      0 :::51513                :::*                                378/avahi-daemon: r

sshd config: 

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
#Port 22

# changed to following ===============
Port 8291
Port 8000
# Use these options to restrict which interfaces/protocols sshd will bind to


#ListenAddress ::
# should I listen of the gateway 192.168.0.1 ?? ? ?

ListenAddress  0.0.0.0
Protocol 2

# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin without-password
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

# is there anything to do with this ? ? ?
#MaxStartups 10:30:60


#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

auth log after remote attempt and later I've ssh from LAN ubuntu box that's logged here (details): 

    Aug  7 08:06:59 raspberrypi sudo: pam_unix(sudo:session): session opened for user root by pi(uid=0)
Aug  7 08:06:59 raspberrypi sudo: pam_unix(sudo:session): session closed for user root
Aug  7 08:17:01 raspberrypi CRON[1329]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug  7 08:17:01 raspberrypi CRON[1329]: pam_unix(cron:session): session closed for user root
Aug  7 08:36:33 raspberrypi sshd[956]: Received disconnect from 192.168.0.13: 11: disconnected by user
Aug  7 08:36:33 raspberrypi sshd[939]: pam_unix(sshd:session): session closed for user pi
Aug  7 08:36:33 raspberrypi systemd-logind[372]: Removed session c3.
Aug  7 08:36:50 raspberrypi sshd[1374]: Connection closed by 192.168.0.13 [preauth]
Aug  7 08:17:05 raspberrypi systemd-logind[360]: New seat seat0.
Aug  7 08:17:05 raspberrypi sshd[469]: Server listening on 0.0.0.0 port 8000.
Aug  7 08:17:05 raspberrypi sshd[469]: Server listening on 0.0.0.0 port 8291.
Aug  7 08:17:07 raspberrypi login[564]: pam_unix(login:session): session opened for user pi by LOGIN(uid=0)
Aug  7 08:17:07 raspberrypi sshd[469]: Received SIGHUP; restarting.
Aug  7 08:17:07 raspberrypi systemd: pam_unix(systemd-user:session): session opened for user pi by (uid=0)
Aug  7 08:17:07 raspberrypi systemd-logind[360]: New session c1 of user pi.
Aug  7 08:17:07 raspberrypi sshd[469]: Server listening on 0.0.0.0 port 8000.
Aug  7 08:17:07 raspberrypi sshd[469]: Server listening on 0.0.0.0 port 8291.
Aug  7 08:17:08 raspberrypi lightdm: pam_unix(lightdm-autologin:session): session opened for user pi by (uid=0)
Aug  7 08:17:08 raspberrypi systemd-logind[360]: New session c2 of user pi.
Aug  7 08:17:10 raspberrypi polkitd(authority=local): Registered Authentication Agent for unix-session:c2 (system bus name :1.7 [lxpolkit], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_GB.UTF-8)
Aug  7 14:23:36 raspberrypi sshd[974]: Accepted password for pi from 192.168.0.13 port 42446 ssh2
Aug  7 14:23:36 raspberrypi sshd[974]: pam_unix(sshd:session): session opened for user pi by (uid=0)
Aug  7 14:23:36 raspberrypi systemd-logind[360]: New session c3 of user pi.

Later I've found there's another router between me and my ISP rather than direct public ip (notice the tplink pannel). Has it have any business in this regard ? 

MAC Address:    hex-hex-hex...
IP Address: 192.168.120.231       PPPoE
Subnet Mask:    255.255.255.0    
Default Gateway:    192.168.120.231  
DNS Server: 123.456.789.000 , 8.8.4.4
Online Time:    0 day(s) 03:49:20

my unix firewall is off and iptables -L has simple output. So, how can I resolve the issue ?

ph03n1x
  • 1
  • 2
  • Your ISP is using NAT on its subscribers, and with that, you cannot access your own system from outside. – Tero Kilkanen Aug 07 '17 at 17:17
  • @TeroKilkanen in that case should I have to use third party online ssh service ? no way for direct ssh(ing) with port forwarding ? – ph03n1x Aug 07 '17 at 17:19
  • There is no way because your ISP is doing NAT. Your ISP would first have to do port forward to your external IP, and then you would have to do port forward to your own IP. The first part is very unlikely to happen. I don't know what you mean by third party online SSH service here. – Tero Kilkanen Aug 07 '17 at 17:36
  • Sounds like a routing issue...as if your server is unable to route back to the SSH client. On another note...even with a certificate, you should never allow root login via SSH and you should always disable X11Forwarding. – Alex Aug 07 '17 at 20:13

1 Answers1

1

I had a similar problem before, just not with a Raspberry Pi.. It was because the public IP and the Pi's local IP being different. So pi@public.ip wouldn't work, I had to ssh without passing the username and letting the ssh connect then ask for the username. Then use pi@local.ip to auth.

West

West
  • 11
  • 1