Quantcast
Channel: Debian User Forums
Viewing all articles
Browse latest Browse all 3423

[Software] fresh install v12.6.0 bookworm, can't get ssh going

$
0
0
Hello to all,

I appreciate that you read my question. I try to include as much as I think is nessesary and helpfull. But it has become a long text, sorry for that.
I'm relatively inexperienced with Debian, I know about a few subjects/parts but none in full details. Consider me a newbie.

This is what it is all about.
I want to use a Debian v12.6.0 Bookworm installation and (also) access it through ssh.
I can use ssh local at the machine using password verification only which proves (to me) that ssh is configured right.
But can't make a connection from a remote system.
Due to safety considerations parts of a default installation are inactive or not installed which may be (part of) the cause why I can't get ssh working.
Clearly I mis some point(s) and any advise is welcome.

This is my setup.
Running on a local network IP is all v6, principal IP range 192.168.2.x
A machine with Debian v12.6.0 Bookworm from debian-live-12.6.0-amd64-xfce.iso on 192.168.2.78, name = zwavelstok, username = andre
A virtual machine with Debian v12.6.0 from the same iso as a VirtualBox client on 10.0.2.15, can ping 192.168.2.78, name = vuursteen, username = andre
A machine with ms-windows 10 with VirtualBox host and PuTTY on 192.168.2.107

This is what is available in the rest of this message.
- references to the sites I used for information and guide lines.
- all steps I did to configure 192.168.2.78 to accept ssh connections from remote not in chronological order.
- results from some commands/services like nmap and ufw.
- latest results of `sudo sshd -T | sort` on 192.168.2.78 (at the end of this message).
- latest results of `$ ssh -vv andre@192.168.2.78` on the virtual machine (at the end of this message).

And this is what I did to get ssh going but it still fails.
1) I downloaded and installed the iso from Debian
2) Applied `sudo apt-get update` and `sudo apt-get dist-upgrade`
3) Checked several instructions on how to install and activate ssh (This and this and this and a few more).
3) Installed ufw after reading this and this

Steps I did to install and activate ssh (not in chronological order and with some reboots and restarts of services not all mentioned.)

Code:

    `sudo apt install ufw`    `sudo ufw allow ssh`
And after a reboot:

Code:

    `sudo ufw show added`    Added user rules (see 'ufw status' for running firewall):    ufw allow 22/tcp    `sudo ufw status`    Status: active    To             Action     From    --             ------     ----    22/tcp         ALLOW      Anywhere    22/tcp (v6)    ALLOW      Anywhere (v6)
Installed and uses nmap to check ports.

Code:

    `sudo nmap 192.168.2.78`    Starting Nmap 7.93 ...    Nmap scan report for 192.168.2.78 (192.168.2.78)    Host is up (0.00018s latency).    ...    PORT    State Service    22/tcp  open  ssh    ...
On actual installing and configuring ssh.

Code:

    `sudo apt install openssh-server`    `sudo systemctl status ssh`    ssh.service - OpenBSD Secure Shell server         Loaded: loaded (/lib/systemd/system/ssh.service; enabled; preset: enabled)         Active: active (running) since Sun 2024-08-11 07:27:44 BST; 1h 35min ago           Docs: man:sshd(8)                 man:sshd_config(5)        Process: 776 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)       Main PID: 792 (sshd)          Tasks: 1 (limit: 19022)         Memory: 5.0M            CPU: 23ms         CGroup: /system.slice/ssh.service                 └─792 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"    Aug 11 07:27:44 zwavelstok systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...    Aug 11 07:27:44 zwavelstok sshd[792]: debug1: Set /proc/self/oom_score_adj from 0 to -1000    Aug 11 07:27:44 zwavelstok sshd[792]: debug1: Bind to port 22 on 0.0.0.0.    Aug 11 07:27:44 zwavelstok sshd[792]: Server listening on 0.0.0.0 port 22.    Aug 11 07:27:44 zwavelstok sshd[792]: debug1: Bind to port 22 on ::.    Aug 11 07:27:44 zwavelstok sshd[792]: Server listening on :: port 22.    Aug 11 07:27:44 zwavelstok systemd[1]: Started ssh.service - OpenBSD Secure Shell server.    `~$ ssh-keygen`    `~$ ssh andre@192.168.2.78` // check if a local connection is possible, it was.    `$ sudo journalctl -u ssh.service`    ...    Aug 10 11:33:35 zwavelstok systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...    Aug 10 11:33:35 zwavelstok sshd[710]: Server listening on 0.0.0.0 port 22.    Aug 10 11:33:35 zwavelstok sshd[710]: Server listening on :: port 22.    Aug 10 11:33:35 zwavelstok systemd[1]: Started ssh.service - OpenBSD Secure Shell server.    Aug 10 11:54:48 zwavelstok sshd[710]: Received signal 15; terminating.    Aug 10 11:54:48 zwavelstok systemd[1]: Stopping ssh.service - OpenBSD Secure Shell server...    Aug 10 11:54:48 zwavelstok systemd[1]: ssh.service: Deactivated successfully.    Aug 10 11:54:48 zwavelstok systemd[1]: Stopped ssh.service - OpenBSD Secure Shell server.    Aug 10 11:54:49 zwavelstok systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...    Aug 10 11:54:49 zwavelstok sshd[1891]: Server listening on 0.0.0.0 port 22.    Aug 10 11:54:49 zwavelstok sshd[1891]: Server listening on :: port 22.    Aug 10 11:54:49 zwavelstok systemd[1]: Started ssh.service - OpenBSD Secure Shell server.    Aug 10 18:55:20 zwavelstok sshd[3820]: Accepted password for andre from ::1 port 37798 ssh2    Aug 10 18:55:20 zwavelstok sshd[3820]: pam_unix(sshd:session): session opened for user andre(uid=1000) by (uid=0)    Aug 10 18:55:20 zwavelstok sshd[3820]: pam_env(sshd:session): deprecated reading of user environment enabled
At the ms-windows machine I use PuTTY. Normally is does not give me any problems, also not with other linux based systems.

Code:

    Putty: connect to 192.168.2.78 using ssh.    login as: andre    andre@192.168.2.78's password:    Access denied    andre@192.168.2.78's password:    ...
At the virtual machine I just installed the iso and ssh. Not much more done with the system, ufw is not installed.
Its purpose is to check an ssh connection to 192.168.2.78 and then I most likely will scrap it.
It is an extra check next to the one with PuTTY and it gives me the option to get `ssh -vv ...` output.

Code:

    `~$ ssh andre@192.168.2.78`    andre@192.168.2.78's password:    Permission denied, please try again.    ...
I checked `~/.ssh/known_hosts` at 192.168.2.78 and it contains three different lines.
Unfortunately all is unreadable and I can not identy which line is for which system. (Safety works but is not helpfull while debugging.)
Since I tried to make an ssh connection from three differend locations I assume that ssh is registering systems correctly.

I checked ufw logs to see for details on any failed connection attemt.
There is none, only information about the (successfull) local connection attemt.
Do my remote systems actualy make a connection to 192.168.2.78?
This remark in stackexchange explains my doubts.
Also, note that the default behavior of sshd when password authentication is disabled is to still display a password prompt. In this situation, the prompt will be completely fake and its only purpose is to make an intruder waste their time futilely trying to guess passwords. So if you see a password prompt, it does not necessarily mean password authentication is actually available.
unquote.
Results from `~$ sudo sshd -T | sort` on 192.168.2.78

Code:

acceptenv LANGacceptenv LC_*addressfamily anyallowagentforwarding yesallowstreamlocalforwarding yesallowtcpforwarding yesallowusers andreauthenticationmethods anyauthorizedkeyscommand noneauthorizedkeyscommanduser noneauthorizedkeysfile .ssh/authorized_keys .ssh/authorized_keys2authorizedprincipalscommand noneauthorizedprincipalscommanduser noneauthorizedprincipalsfile nonebanner nonecasignaturealgorithms ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256chrootdirectory noneciphers chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.comclientalivecountmax 3clientaliveinterval 0compression yesdisableforwarding noexposeauthinfo nofingerprinthash SHA256forcecommand nonegatewayports nogssapiauthentication nogssapicleanupcredentials yesgssapikexalgorithms gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1-gssapikeyexchange nogssapistorecredentialsonrekey nogssapistrictacceptorcheck yeshostbasedacceptedalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256hostbasedauthentication nohostbasedusesnamefrompacketonly nohostkeyagent nonehostkeyalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256hostkey /etc/ssh/ssh_host_ecdsa_keyhostkey /etc/ssh/ssh_host_ed25519_keyhostkey /etc/ssh/ssh_host_rsa_keyignorerhosts yesignoreuserknownhosts noipqos lowdelay throughputkbdinteractiveauthentication yeskerberosauthentication nokerberosorlocalpasswd yeskerberosticketcleanup yeskexalgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256listenaddress 0.0.0.0:22listenaddress [::]:22logingracetime 120loglevel DEBUGmacs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1maxauthtries 6maxsessions 10maxstartups 10:30:100modulifile /etc/ssh/modulipasswordauthentication yespermitemptypasswords nopermitlisten anypermitopen anypermitrootlogin without-passwordpermittty yespermittunnel nopermituserenvironment nopermituserrc yespersourcemaxstartups nonepersourcenetblocksize 32:128pidfile /run/sshd.pidport 22printlastlog yesprintmotd nopubkeyacceptedalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256pubkeyauthentication nopubkeyauthoptions nonerekeylimit 0 0requiredrsasize 1024revokedkeys nonesecuritykeyprovider internalstreamlocalbindmask 0177streamlocalbindunlink nostrictmodes yessubsystem sftp /usr/lib/openssh/sftp-serversyslogfacility AUTHtcpkeepalive yestrustedusercakeys noneunusedconnectiontimeout noneusedns nousepam yesversionaddendum nonex11displayoffset 10x11forwarding yesx11uselocalhost yesxauthlocation /usr/bin/xauth 
Results from `ssh -vv andre@192.168.2.78` on the virtual machine.

Code:

andre@vuursteen:~$ ssh -vv andre@192.168.2.78OpenSSH_9.2p1 Debian-2+deb12u2, OpenSSL 3.0.13 30 Jan 2024debug1: Reading configuration data /etc/ssh/ssh_configdebug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no filesdebug1: /etc/ssh/ssh_config line 21: Applying options for *debug2: resolve_canonicalize: hostname 192.168.2.78 is addressdebug1: Connecting to 192.168.2.78 [192.168.2.78] port 22.debug1: Connection established.debug1: identity file /home/andre/.ssh/id_rsa type -1debug1: identity file /home/andre/.ssh/id_rsa-cert type -1debug1: identity file /home/andre/.ssh/id_ecdsa type -1debug1: identity file /home/andre/.ssh/id_ecdsa-cert type -1debug1: identity file /home/andre/.ssh/id_ecdsa_sk type -1debug1: identity file /home/andre/.ssh/id_ecdsa_sk-cert type -1debug1: identity file /home/andre/.ssh/id_ed25519 type -1debug1: identity file /home/andre/.ssh/id_ed25519-cert type -1debug1: identity file /home/andre/.ssh/id_ed25519_sk type -1debug1: identity file /home/andre/.ssh/id_ed25519_sk-cert type -1debug1: identity file /home/andre/.ssh/id_xmss type -1debug1: identity file /home/andre/.ssh/id_xmss-cert type -1debug1: identity file /home/andre/.ssh/id_dsa type -1debug1: identity file /home/andre/.ssh/id_dsa-cert type -1debug1: Local version string SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u2debug1: Remote protocol version 2.0, remote software version OpenSSH_8.2debug1: compat_banner: match: OpenSSH_8.2 pat OpenSSH* compat 0x04000000debug2: fd 3 setting O_NONBLOCKdebug1: Authenticating to 192.168.2.78:22 as 'andre'debug1: load_hostkeys: fopen /home/andre/.ssh/known_hosts2: No such file or directorydebug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directorydebug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directorydebug1: SSH2_MSG_KEXINIT sentdebug1: SSH2_MSG_KEXINIT receiveddebug2: local client KEXINIT proposaldebug2: KEX algorithms: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.comdebug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.comdebug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.comdebug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1debug2: compression ctos: none,zlib@openssh.com,zlibdebug2: compression stoc: none,zlib@openssh.com,zlibdebug2: languages ctos: debug2: languages stoc: debug2: first_kex_follows 0 debug2: reserved 0 debug2: peer server KEXINIT proposaldebug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.comdebug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.comdebug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1debug2: compression ctos: none,zlib@openssh.comdebug2: compression stoc: none,zlib@openssh.comdebug2: languages ctos: debug2: languages stoc: debug2: first_kex_follows 0 debug2: reserved 0 debug1: kex: algorithm: curve25519-sha256debug1: kex: host key algorithm: ssh-ed25519debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: nonedebug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: nonedebug1: expecting SSH2_MSG_KEX_ECDH_REPLYdebug1: SSH2_MSG_KEX_ECDH_REPLY receiveddebug1: Server host key: ssh-ed25519 SHA256:TRKBQ4Q5eABKuaK4c7XYtClGj55ITDgt7jKb5cAbAlIdebug1: load_hostkeys: fopen /home/andre/.ssh/known_hosts2: No such file or directorydebug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directorydebug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directorydebug1: Host '192.168.2.78' is known and matches the ED25519 host key.debug1: Found key in /home/andre/.ssh/known_hosts:1debug2: ssh_set_newkeys: mode 1debug1: rekey out after 134217728 blocksdebug1: SSH2_MSG_NEWKEYS sentdebug1: expecting SSH2_MSG_NEWKEYSdebug1: SSH2_MSG_NEWKEYS receiveddebug2: ssh_set_newkeys: mode 0debug1: rekey in after 134217728 blocksdebug1: get_agent_identities: bound agent to hostkeydebug1: get_agent_identities: ssh_fetch_identitylist: agent contains no identitiesdebug1: Will attempt key: /home/andre/.ssh/id_rsa debug1: Will attempt key: /home/andre/.ssh/id_ecdsa debug1: Will attempt key: /home/andre/.ssh/id_ecdsa_sk debug1: Will attempt key: /home/andre/.ssh/id_ed25519 debug1: Will attempt key: /home/andre/.ssh/id_ed25519_sk debug1: Will attempt key: /home/andre/.ssh/id_xmss debug1: Will attempt key: /home/andre/.ssh/id_dsa debug2: pubkey_prepare: donedebug1: SSH2_MSG_EXT_INFO receiveddebug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com>debug2: service_accept: ssh-userauthdebug1: SSH2_MSG_SERVICE_ACCEPT receiveddebug1: Authentications that can continue: publickey,passworddebug1: Next authentication method: publickeydebug1: Trying private key: /home/andre/.ssh/id_rsadebug1: Trying private key: /home/andre/.ssh/id_ecdsadebug1: Trying private key: /home/andre/.ssh/id_ecdsa_skdebug1: Trying private key: /home/andre/.ssh/id_ed25519debug1: Trying private key: /home/andre/.ssh/id_ed25519_skdebug1: Trying private key: /home/andre/.ssh/id_xmssdebug1: Trying private key: /home/andre/.ssh/id_dsadebug2: we did not send a packet, disable methoddebug1: Next authentication method: passwordandre@192.168.2.78's password:

Statistics: Posted by papaathome — 2024-08-11 09:46 — Replies 0 — Views 24



Viewing all articles
Browse latest Browse all 3423

Trending Articles