SSH issues on standalone linux boxes

[nuzzy]

Hello,

I'm having some REALLY weird issues with ssh. We have two separate networks set up. One production and one test. Traffic is allowed to flow to the test net, but only ssh is allowed back and forth between the two. We were testing ssh from production to test using PuTTY on a Windows machine with no errors. However, using a redhat and a Ubuntu box to the test didn't work. It just sat there. Note that the linux boxes had both iptables and selinux off.

Also, these go thru Cisco ASA's. After watching logging and opening up to see if PERMIT: ANY/ANY worked, we still had no success. It looked like ssh made a connection to the test box, but then it got a SYN Timeout, so I'm not sure what's going on. To complicate things even further, a Solaris box on the production net which also runs OpenSSH can connect to the test, as can VMWare images (Ubuntu, Fedora) on my local machine on the production network.

This is what the ssh output looks like:

ssh -vvv 192.168.101.5
OpenSSH_5.1p1 Debian-5ubuntu1, OpenSSL 0.9.8g 19 Oct 2007
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 192.168.101.5 [192.168.101.5] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1

It will just sit there until I end it and the SSH server doesn't log any connection output.

I've also tried adding the authorized_keys to no avail.

Any possible ideas? I'm out of them!

P.S. - It seems to only happen on standalone linux boxes as well.

 

[eVAPor8]

I'm no expert on Secure Shell, but those last two messages regarding RSA and DSA would have me looking at my Certificates and checking that the client is properly set up.

It looks to me like the initial connection is being made but from there on you have a some sort on decryption failure so the two machines aren't "talking the same language" (so to speak).

You might also try a sniffer trace to look at the conversation in more depth

I used to be the Comaboy on Tek-Tips.

...And the despicable Jeremy Vyle elsewhere.

 

[North323]

can you verify you have correct routes back to the red hat box?