Score:0

Yet another SSH connection timeout

ar flag

This one is puzzling me to no end. By using PuTTY (latest version) I was able to connect from Windows 10 to Ubuntu 18.04 via SSH (local network), and I've been doing it for over a year until it mysteriously stopped working for no apparent reason.

In the Ubuntu 18 machine the SSH service is loaded and running. Nmap shows local tcp port 22 is open.

In the Windows 10 machine, putty is getting connection timeout. Nmap shows remote tcp port 22 is filtered.

Actually, every single remote port (pointing to Ubuntu) is filtered. So other services, like VNC, that worked before, now doesn't.

Ubuntu's ufw and apparmor are disabled. I also flushed all iptables rules and left incoming and outcoming connections default to ACCEPT. I also turned off windows firewall/antivirus.

Ubuntu's tcpdump shows windows knocking on port 22, also iptables -A INPUT -s {windowsIP} -j LOG shows the same thing. But there is not a single connection request in auth.log

I manually opened a port in Ubuntu using netcat: ls | nc -l -p 4000 And netstat -tulpn confirms local tcp port 4000 is open and listening in all interfaces (0.0.0.0). Same result; Putty (in telnet mode for this test) gets timed out, and windows's nmap shows remote tcp port 4000 is filtered.

Lastly I directly connected the network card from one machine to the other, I configured static ip on both. The connection was established successfully and both machines can see and ping each other. Then I repeated all tests and got the same results.

Does anyone have any idea of what could be happening? All the clues point that there is something (recently installed) in the Ubuntu machine that is somehow blocking all the incoming connections, but I have no idea what. Thanks in advance.

waltinator avatar
it flag
Could be a packet routing problem. Does `putty` let you increase verbosity (on Ubuntu, `ssh -v ...`, `ssh -vv ...`, `ssh -vvv ...`, for increasing verbosity). On Ubuntu, `ip route show`, for more information. Also `traceroute` from one system to the other. Consider installing `tracepath`, a TCP traceroute. Read `man ip ip-route ssh sshd sshd_config traceroute tracepath`. The Windows equivalents are off-topic for AskUbuntu, but you should test from both ends. Also look at `sudo journalctl -b 0 -u sshd`. Read `man journalctl`.
ar flag
Thank you so much for trying to help. I finally found the solution; there was a service called ds_agent (by trend micro), I killed it and everything started working again. I just wish I had figured this out by debugging and not just sheer luck. Anyway thank you again for take your time to help a stranger.
Score:0
ar flag

For posterity, I finally solved the problem by killing a service named "ds_agente" which is some kind of antivirus/firewall installed remotely without my knowledge.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.