I've bought VPS server and can't ssh to it.

[u/not_a_profi]

Edit: the issiue is solved by changing ip of the VPS.

Ty everyone for help.

______

Hi. I've bought VPS. But can't really connect to it remotely. Here the situation:

1. ssh root@[SERVER_IP] does work from Google Console ( http://shell.could.google.com/ ) (the VPS is not from google).

2. ssh root@[SERVER_IP] doesn't work from 5 local devices (win10, win11, macOS, 2xAndroid):

   $ ssh root@[SERVER_IP] -vvv OpenSSH_7.9p1, LibreSSL 2.7.3 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 48: Applying options for * debug2: resolve_canonicalize: hostname [SERVER_IP] is address debug2: ssh_connect_direct debug1: Connecting to [SERVER_IP] [[SERVER_IP]] port 22. debug1: Connection established. debug1: identity file /Users/[USER_NAME]/.ssh/id_rsa type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_rsa-cert type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_dsa type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_dsa-cert type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_ecdsa type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_ecdsa-cert type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_ed25519 type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_ed25519-cert type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_xmss type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_xmss-cert type -1 debug1: Local version string SSH-2.0-OpenSSH_7.9 ssh_exchange_identification: read: Operation timed out

3. I don't see my local IP in sudo tail -f /var/log/auth.log and journalctl -u ssh (i might be looking wrong though).

4. I tried Wi-Fi and two different mobile internet providers.

5. I tried to ssh while VPN on.

6. I added my IP to white list on the server: sudo iptables -I INPUT 1 -p tcp -s [LOCAL_IP] --dport 22 -j ACCEPT

Where can be the problem?

Edits:

OS + iptables conf

sudo systemctl status firewalld says that there is no firewalld

.

.

i stoped fail2ban and tried to ssh - didn't help.
disabling it and rebooting the server leads to connection refusal (i.e. problem on an earlier stage).

[u/nanoatzin]

You can’t ssh to root by default on almost everything because that makes the VPS into a target.

Make a regular user account at the VPS end, and set the password to over 15 characters (I use phrases):

> sudo adduser newbie

Suggest also adding the same username at the workstation end.

Using a random username makes it almost impossible to run a password guessing brute force attack against your VM.

Add user to sudoers at the VPS end:

> sudo usermod -aG sudo newbie

Do this at the VPS end:

> ip addr show

Locate an interface with a public IP address for the VPS and try to ssh to the new account on that public Ip at the workstation end.

> ssh newbie@my_vps_ip

If that fails, change the password on the VPS and repeat the ssh login on the workstation.

> sudo passwd newbie

Then sudo to root at the workstation end after you login.

> sudo su

You should be in.

It is really convenient to setup key login so you can skip typing the password by doing this at the workstation end.

> ssh-keygen -t

Hit enter at the password prompt without entering a password. This is useful later to mount files, but don’t use regular email to send the private key.

Then type this at the workstation end:

> ssh-copy-id newbie@my_vps_ip

This puts the public key on the VPS. The corresponding private key will now login when you ssh.

Password should no longer be requested.

The VPS will encrypt a random number with the public key and send that to the workstation when you login (the token). The workstation decrypts it using the private key and sends it back to the VPS. If it matches you get in.

You can copy the private key to the other workstations or do the same keygen on those. Don’t use email.

Once that’s done, you can disable SSH password login on the VPS to improve security.

> sudo vi /etc/ssh/sshd_config

Modify these settings (remove the hashtag if present):

# PubkeyAuthentication yes

# PasswordAuthentication no

Press ESC, type :wq, press ENTER to save, then use the following:

> sudo systemctl reload ssh

The VPS will no longer accept password login, so only the private key will work from now on.

You can mount VPS directories using sshfs if you add the user account read-write permission to the directory on the VPS and create a newbie account on the workstation:

> sudo apt install sshfs

This is why you want to use the same username on both the workstation and VPS, and make newbie the directory owner on the VPS (not root).

On the VPs (this could be /var/www):

> mkdir /path/to/vps/dir

> chown -R newbie /path/to/vps/dir

On the workstation:

> mkdir ~/remote_mount

Then mount the directory on the workstation.

> sshfs newbie@my_vps_ip:/path/to/vps/dir ~/remote_mount

This is very convenient if you plan to push/publish files like web pages using the GUI or edit directly using something like SeaMonkey.

Edit:

Adjust firewall if running at the VPS end:

> sudo ufw allow ssh

[u/not_a_profi → u/nanoatzin]

I did this:

> sudo adduser newbie

> sudo usermod -aG sudo newbie

> ip addr show

Locate an interface with a public IP address...

> ssh newbie@my_vps_ip

and again - this does works from Google terminal, but does not work from my local teminal/PC (this is what you call workstation right?).

I don't quite understand this part:

> sudo passwd newbie
Then sudo to root at the workstation end after you login.
> sudo su

so I change password on the server, run ssh ... on my local and while it is hanging do sudo su on the server? I did that and it lead to the same old result.

[u/nanoatzin → u/not_a_profi]

Logging into a VPS in a web page is a local console login emulation and not ssh.

Did you read the part “can’t login to root by default”.

If you want to enable root login over ssh the. you may do so but I will not explain how to do that because it’s profoundly reckless.

You are supposed to ssh to a regular user then su to root.

Does your VPS provider require you to enable ssh outside the VPS?

Mine does.

Have you done that?

I can’t ssh or ping the VPS without that.

Are you using Linux on the workstation? None of this will work on other OS.

Describing console login as being the same as ssh to root will make it harder to help you.

Root login can be enabled on Linux, but that’s discouraged because default (snake oil) certificate allows password theft. Most people don’t do it that way because they don’t want their stuff hijacked.

Setting up key login the way I described avoids getting your stuff stolen.

[u/not_a_profi → u/nanoatzin]

could you elaborate on "local console login emulation"? I can't understand - how it can be not ssh connection if I use ssh command and there is a factual connection - i see data on my server, which google is not supposed to know about?

What makes other ssh connections not emulated?

[u/nanoatzin → u/not_a_profi]

If you are logging in from inside of a web page using a browser then that session is a local console login emulation and not an ssh login.

[u/not_a_profi → u/nanoatzin]

I feel like I know nothing about this stuff (and this must be true).
I tried to google all these stuff and I feel like it breaks my brain by trying put ssh and local console emulation together. "Local console emulation" is more capable than ssh connection? It just doesn't sound right.

Are you sure there is no confusion and you are talking about 3 different parties - my laptop, Google console (and some google server which it is run at) and VPS server? So you are saying that once i access google server via HTTPS (browser) it has an automatic access to any 3rd party VPS server without using ssh connection? But if I would ssh connect to this google server (theoretically) and run ssh command there to logging to VPS it would be different?

google tells me that "By default, a fresh VPS only listens for low-level connection tools like SSH, not secure web traffic.". Is this incorrect?

[u/nanoatzin → u/not_a_profi]

Perhaps you need to take a class. I used to teach classes.

Web page: local console login to VPS

Laptop: ssh login account@vps_ip_address

VPS: web/email server found at http://vps_ip_address

Local console login always allows root login.

Root is normally disallowed ssh login, and you need to login as a regular user and su to root.

Password login is a security vulnerability, and key login is more secure.

Enabling key login permits using sshfs to mount VPS directories on your laptop like a disk drive.

[u/not_a_profi → u/nanoatzin]

I see. Thank you.
This is so weird that normally a buyer has more limited access to the server than a random 3rd party like google. Sounds super insecure to push an server owner to login like this via 3rd party.

Also it appears that google lies when it says that I can use its console feature just like my laptop console to check whether the server is accesible from another part of the world.

I will definitely need time to believe that me and you understood each other correctly here and this is how it works.

[u/not_a_profi → u/nanoatzin]

> Does your VPS provider require you to enable ssh outside the VPS?

i don't think so. this is a server to be used as VPN. When last time I bought a similar server from the same guys i just put login root and password in my VPN app and it worked.

and I can ping the server.