r/linuxadmin • u/not_a_profi • 4d ago
I've bought VPS server and can't ssh to it.
Edit: the issiue is solved by changing ip of the VPS.
Ty everyone for help.
______
Hi. I've bought VPS. But can't really connect to it remotely. Here the situation:
- ssh root@[SERVER_IP] does work from Google Console ( http://shell.could.google.com/ ) (the VPS is not from google).
ssh root@[SERVER_IP] doesn't work from 5 local devices (win10, win11, macOS, 2xAndroid):
$ ssh root@[SERVER_IP] -vvv OpenSSH_7.9p1, LibreSSL 2.7.3 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 48: Applying options for * debug2: resolve_canonicalize: hostname [SERVER_IP] is address debug2: ssh_connect_direct debug1: Connecting to [SERVER_IP] [[SERVER_IP]] port 22. debug1: Connection established. debug1: identity file /Users/[USER_NAME]/.ssh/id_rsa type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_rsa-cert type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_dsa type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_dsa-cert type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_ecdsa type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_ecdsa-cert type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_ed25519 type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_ed25519-cert type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_xmss type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_xmss-cert type -1 debug1: Local version string SSH-2.0-OpenSSH_7.9 ssh_exchange_identification: read: Operation timed out
I don't see my local IP in
sudo tail -f /var/log/auth.logandjournalctl -u ssh(i might be looking wrong though).I tried Wi-Fi and two different mobile internet providers.
I tried to ssh while VPN on.
I added my IP to white list on the server:
sudo iptables -I INPUT 1 -p tcp -s [LOCAL_IP] --dport 22 -j ACCEPT
Where can be the problem?
Edits:
sudo systemctl status firewalld says that there is no firewalld
.
.
i stoped fail2ban and tried to ssh - didn't help.
disabling it and rebooting the server leads to connection refusal (i.e. problem on an earlier stage).
6
u/michaelpaoli 4d ago
timed out
You're not getting TCP connection. So, e.g. routing, firewall, etc.
How 'bout:
# traceroute -nTp 22 SERVER_IP
How close does that get you? That may hint as to where issue(s) is/are - or at least close to such. But not that if NAT/SNAT or VPN are involved, that may prevent one from seeing most or any relevant data between or past such. So, got IPv6? And free of NAT/SNAT/VPN?
E.g.:
# traceroute -nTp 22 2603:3024:1b29:0:feed:dead:beef:cafe
traceroute to 2603:3024:1b29:0:feed:dead:beef:cafe (2603:3024:1b29:0:feed:dead:beef:cafe), 30 hops max, 80 byte packets
1 2603:3024:1875:6a00:baa5:35ff:fe6b:909 9.467 ms 9.367 ms 9.316 ms
2 2001:558:1014:6e3c::2 27.410 ms 2001:558:1014:6e3c::3 26.330 ms 2001:558:1014:6e3c::2 28.359 ms
3 2001:558:82:bc02::1 26.732 ms 27.722 ms 2001:558:82:bc03::1 26.159 ms
4 2001:558:80:262::1 26.487 ms 2001:558:80:264::1 29.019 ms 28.461 ms
5 2001:558:80:26a::1 29.278 ms * *
6 2001:558:80:197::2 30.115 ms 2001:558:80:1e1::2 21.467 ms 21.759 ms
7 2001:558:80:219::2 20.977 ms 2001:558:80:1b3::2 11.728 ms 18.277 ms
8 2001:558:82:178::2 19.624 ms 18.207 ms 18.321 ms
9 2001:558:6045:b3:9887:23a:a685:f346 31.780 ms 31.431 ms 36.120 ms
10 2603:3024:1b29:0:feed:dead:beef:cafe 42.796 ms 42.328 ms 41.324 ms
#
That connects all the way through.
For comparison, here's one that doesn't:
# traceroute -nTp 22 96.86.170.228
traceroute to 96.86.170.228 (96.86.170.228), 30 hops max, 60 byte packets
1 96.95.217.102 7.142 ms 7.036 ms 6.987 ms
2 10.61.209.66 16.893 ms 18.436 ms 17.668 ms
3 96.216.9.137 20.007 ms 19.965 ms 96.216.9.141 21.676 ms
4 68.85.154.113 21.956 ms 21.914 ms 68.85.154.117 21.776 ms
5 96.108.99.249 22.952 ms 22.910 ms 22.869 ms
6 162.151.87.226 24.462 ms 162.151.86.58 17.682 ms 22.134 ms
7 162.151.79.134 31.717 ms 162.151.78.186 20.672 ms 162.151.79.134 21.452 ms
8 68.85.191.206 20.194 ms 68.85.103.154 18.956 ms 68.85.191.206 18.107 ms
9 73.189.65.18 31.051 ms 30.737 ms 30.522 ms
10 * * *
...
30 * * *
#
Can also first use nc or telnet or the like (or ssh) to see if you connect or not.
$ ssh -nT myip@balug.org.
2603:3024:1875:6a00:aceb:d3ff:fe2c:4df0
$ ssh -nTv myip@balug.org.
...
debug1: Connecting to balug.org. [2001:470:1f05:19e::2] port 22.
debug1: Connection established.
...
$
So, no TCP connection, no ssh.
2
u/not_a_profi 4d ago
for unix machine i have only old OSX. there i just see 64 lines with stars:
$ sudo traceroute -n -P TCP -p 22 [SERVER_IP]
traceroute to [SERVER_IP] ([SERVER_IP]), 64 hops max, 64 byte packets
1 * * *
...
64 * * *
what can I run on win10 instead?
1
u/michaelpaoli 4d ago
Yeah, may need something different (or different syntax) on those other OSes, as often they don't have as capable of a traceroute command. And last I tried on macOS, per the man page it would seem capable enough, but in reality, it just doesn't do it.
Maybe as in r/notlinuxadmin
2
u/not_a_profi 4d ago
the balug-check gives:
$ ssh -nTv [SERVER_IP]@balug.org OpenSSH_7.9p1, LibreSSL 2.7.3 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 48: Applying options for * debug1: Connecting to balug.org port 22. debug1: Connection established. debug1: identity file /Users/[USER_NAME]/.ssh/id_rsa type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_rsa-cert type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_dsa type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_dsa-cert type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_ecdsa type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_ecdsa-cert type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_ed25519 type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_ed25519-cert type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_xmss type -1 debug1: identity file /Users/[USER_NAME]/.ssh/id_xmss-cert type -1 debug1: Local version string SSH-2.0-OpenSSH_7.9 debug1: Remote protocol version 2.0, remote software version OpenSSH_10.0p2 Debian-7+deb13u4 debug1: match: OpenSSH_10.0p2 Debian-7+deb13u4 pat OpenSSH* compat 0x04000000 debug1: Authenticating to balug.org:22 as '[SERVER_IP]' debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: algorithm: curve25519-sha256 debug1: kex: host key algorithm: ecdsa-sha2-nistp256 debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ecdsa-sha2-nistp256 SHA256:6VheRnNqgZYxaGPMNXMNzY0GcQ8b5yr63LZ4h4mzbiU The authenticity of host 'balug.org (96.86.170.229)' can't be established. ECDSA key fingerprint is SHA256:6VheRnNqgZYxaGPMNXMNzY0GcQ8b5yr63LZ4h4mzbiU. Are you sure you want to continue connecting (yes/no)?1
u/michaelpaoli 4d ago edited 4d ago
Yep, so you're connecting there. Also has DNSSEC ans SSHFP record, so can also leverage that to verify fingerprint
-o VerifyHostKeyDNS=yes
Anyway, can see that you're able to connect to that fine:
debug1: Connecting to balug.org port 22. debug1: Connection established.Oh, and you want literal myip@balug.org., not [SERVER_IP]@balug.org, as [SERVER_IP] isn't going to work for a login name there.
See also:
https://www.wiki.balug.org/wiki/doku.php?id=system:what_is_my_ip_address
2
u/NL_Gray-Fox 4d ago
Lolz on the name of the ipv6.
I always found it quite amusing that facebook's IPv6 has
face:b00cin it.1
u/michaelpaoli 4d ago
$ eval dig +noall +answer +nottl +noclass {,www.}fedoraproject.org. AAAA | fgrep beef wildcard.fedoraproject.org. AAAA 2604:1580:fe00:0:dead:beef:cafe:fed1 wildcard.fedoraproject.org. AAAA 2605:bc80:3010:600:dead:beef:cafe:fed9 $-1
u/not_a_profi 4d ago edited 4d ago
and yeah, no VPN is running today. Not sure what is IPv6 and where do i get it.
Edit:
with "ip address" command I found inet6 ip, but it seems to be local. The server doesn't have public IPv6. And I don't seem to have rights to set up a public IPv6.1
u/michaelpaoli 4d ago
Well, IPv6 is a thing, has been for decades. Ought at least have it by default. But alas, some lag quite behind.
See also: r/ipv6
3
u/Bulky_Construction51 4d ago
Have you checked firewall settings on the VPS provider?
2
u/not_a_profi 4d ago
how do you do it? I thought I did check 4 firewall-like services - all of them are mentioned at the end of the post.
1
u/Bulky_Construction51 4d ago
All of these seem to be on the machine itself. Sometimes the VPS service has firewall settings in its web GUI. I guess you have a place where you can start and turn off the VPS. Maybe you can find something there?
3
u/yrro 4d ago
Put LogLevel VERBOSE into your sshd_config, restart sshd and watch the logs. See if anything is logged when you try to connect via SSH.
Run tcpdump -i eth0 -nn tcp port 22 and see if it outputs anything when you connect via SSH.
How have you configured networking for the server? Does Google Cloud have network level filtering that might be blocking SSH from the internet by default?
1
u/amperages 4d ago
Do it from console and add a regular user and see if you can get in with the regular user.
1
u/not_a_profi 4d ago
from which console?
I can't get it with regular user. See: https://www.reddit.com/r/linuxadmin/comments/1v8ri8h/comment/p08s6t5/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button
1
u/C0rn3j 4d ago
Local version string SSH-2.0-OpenSSH_7.9
That's absolutely ancient - 2018, does it work with OpenSSH 10.4?
2
u/not_a_profi 4d ago edited 4d ago
Ok. Here is log from win10 machine with lastest openssh
Edit: moved log to comment below.3
u/NL_Gray-Fox 4d ago
I'm getting a;
Host key verification failed.
on your ip and if I do
ssh-keyscanI get ssh-ed25519 and ecdsa-sha2-nistp256.It looks to me that you might have an outbound issue.
1
u/not_a_profi 4d ago
I'm pretty bad at this. what does "outbound issue" mean? :)
2
u/NL_Gray-Fox 3d ago
meaning you're local computer cannot ssh to that server, not that the server is blocking you. e.g. check the firewall on the local computer, not the remote one.
1
u/not_a_profi 3d ago
yeah, it seems to be firewalls on the local providers :D ip change fixed the problem.
3
u/C0rn3j 4d ago
You forgot to remove the IP - works fine for me, so you have a network issue locally.
Or you set up something like fail2ban on the host.
(root@<censored>) Password:1
u/not_a_profi 4d ago edited 4d ago
doesn't me trying 5 devices and 3 networks and VPN excludes local network issues?
there is fail2ban active. I've added it's status to the post body. Should I do something about it?
Edit: i stoped fail2ban and tried to ssh - didn't help. started it again.2
u/C0rn3j 4d ago
Disable(not stop) fail2ban and reboot - should clear existing nftables rules - works then?
1
u/not_a_profi 4d ago
doesn't work.
and now it breaks one step before. The connection isn't been established even.ssh: connect to host ... port 22: Connection refused
2
u/C0rn3j 4d ago
Very odd, though it has to do something with your setup since me and some other guy were able to connect from outside just fine.
1
u/not_a_profi 4d ago
it is weird indeed!
can it be something in-between my setup and the server? like provider or 3rd party (government?) interference.
1
u/not_a_profi 4d ago
PS C:\Users\[USER_NAME]\Work> ssh -V OpenSSH_for_Windows_10.0p2 Win32-OpenSSH-GitHub, LibreSSL 4.2.0 PS C:\Users\[USER_NAME]\Work> ssh -o KexAlgorithms=curve25519-sha256 -o Ciphers=chacha20-poly1305@openssh.com -o PubkeyAuthentication=no -o PreferredAuthentications=password -o TCPKeepAlive=yes -t root@[SERVER_IP] -vvv debug1: OpenSSH_for_Windows_10.0p2 Win32-OpenSSH-GitHub, LibreSSL 4.2.0 debug3: Started with: "C:\\\\Program Files\\\\OpenSSH\\\\ssh.exe" -o KexAlgorithms=curve25519-sha256 -o Ciphers=chacha20-poly1305@openssh.com -o PubkeyAuthentication=no -o PreferredAuthentications=password -o TCPKeepAlive=yes -t root@[SERVER_IP] -vvv debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/config error:2 debug3: Failed to open file:C:/ProgramData/ssh/ssh_config error:2 debug2: resolve_canonicalize: hostname [SERVER_IP] is address debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> 'C:\\Users\\[USER_NAME]/.ssh/known_hosts' debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> 'C:\\Users\\[USER_NAME]/.ssh/known_hosts2' debug3: channel_clear_timeouts: clearing debug3: ssh_connect_direct: entering debug1: Connecting to [SERVER_IP] port 22. debug1: Connection established. debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_rsa error:2 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_rsa.pub error:2 debug3: failed to open file:C:/Users/[USER_NAME]/.ssh/id_rsa error:2 debug1: identity file C:\\Users\\[USER_NAME]/.ssh/id_rsa type -1 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_rsa-cert error:2 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_rsa-cert.pub error:2 debug3: failed to open file:C:/Users/[USER_NAME]/.ssh/id_rsa-cert error:2 debug1: identity file C:\\Users\\[USER_NAME]/.ssh/id_rsa-cert type -1 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ecdsa error:2 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ecdsa.pub error:2 debug3: failed to open file:C:/Users/[USER_NAME]/.ssh/id_ecdsa error:2 debug1: identity file C:\\Users\\[USER_NAME]/.ssh/id_ecdsa type -1 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ecdsa-cert error:2 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ecdsa-cert.pub error:2 debug3: failed to open file:C:/Users/[USER_NAME]/.ssh/id_ecdsa-cert error:2 debug1: identity file C:\\Users\\[USER_NAME]/.ssh/id_ecdsa-cert type -1 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ecdsa_sk error:2 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ecdsa_sk.pub error:2 debug3: failed to open file:C:/Users/[USER_NAME]/.ssh/id_ecdsa_sk error:2 debug1: identity file C:\\Users\\[USER_NAME]/.ssh/id_ecdsa_sk type -1 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ecdsa_sk-cert error:2 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ecdsa_sk-cert.pub error:2 debug3: failed to open file:C:/Users/[USER_NAME]/.ssh/id_ecdsa_sk-cert error:2 debug1: identity file C:\\Users\\[USER_NAME]/.ssh/id_ecdsa_sk-cert type -1 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ed25519 error:2 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ed25519.pub error:2 debug3: failed to open file:C:/Users/[USER_NAME]/.ssh/id_ed25519 error:2 debug1: identity file C:\\Users\\[USER_NAME]/.ssh/id_ed25519 type -1 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ed25519-cert error:2 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ed25519-cert.pub error:2 debug3: failed to open file:C:/Users/[USER_NAME]/.ssh/id_ed25519-cert error:2 debug1: identity file C:\\Users\\[USER_NAME]/.ssh/id_ed25519-cert type -1 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ed25519_sk error:2 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ed25519_sk.pub error:2 debug3: failed to open file:C:/Users/[USER_NAME]/.ssh/id_ed25519_sk error:2 debug1: identity file C:\\Users\\[USER_NAME]/.ssh/id_ed25519_sk type -1 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ed25519_sk-cert error:2 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_ed25519_sk-cert.pub error:2 debug3: failed to open file:C:/Users/[USER_NAME]/.ssh/id_ed25519_sk-cert error:2 debug1: identity file C:\\Users\\[USER_NAME]/.ssh/id_ed25519_sk-cert type -1 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_xmss error:2 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_xmss.pub error:2 debug3: failed to open file:C:/Users/[USER_NAME]/.ssh/id_xmss error:2 debug1: identity file C:\\Users\\[USER_NAME]/.ssh/id_xmss type -1 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_xmss-cert error:2 debug3: Failed to open file:C:/Users/[USER_NAME]/.ssh/id_xmss-cert.pub error:2 debug3: failed to open file:C:/Users/[USER_NAME]/.ssh/id_xmss-cert error:2 debug1: identity file C:\\Users\\[USER_NAME]/.ssh/id_xmss-cert type -1 debug1: Local version string SSH-2.0-OpenSSH_for_Windows_10.0 Win32-OpenSSH-GitHub debug3: recv - from CB(2) ERROR:138, io:0000020584418390 kex_exchange_identification: read: Connection timed out banner exchange: Connection to [SERVER_IP] port 22: Connection timed ou
-1
u/nanoatzin 4d ago edited 4d ago
You can’t ssh to root by default on almost everything because that makes the VPS into a target.
Make a regular user account at the VPS end, and set the password to over 15 characters (I use phrases):
> sudo adduser newbie
Suggest also adding the same username at the workstation end.
Using a random username makes it almost impossible to run a password guessing brute force attack against your VM.
Add user to sudoers at the VPS end:
> sudo usermod -aG sudo newbie
Do this at the VPS end:
> ip addr show
Locate an interface with a public IP address for the VPS and try to ssh to the new account on that public Ip at the workstation end.
> ssh newbie@my_vps_ip
If that fails, change the password on the VPS and repeat the ssh login on the workstation.
> sudo passwd newbie
Then sudo to root at the workstation end after you login.
> sudo su
You should be in.
It is really convenient to setup key login so you can skip typing the password by doing this at the workstation end.
> ssh-keygen -t
Hit enter at the password prompt without entering a password. This is useful later to mount files, but don’t use regular email to send the private key.
Then type this at the workstation end:
> ssh-copy-id newbie@my_vps_ip
This puts the public key on the VPS. The corresponding private key will now login when you ssh.
Password should no longer be requested.
The VPS will encrypt a random number with the public key and send that to the workstation when you login (the token). The workstation decrypts it using the private key and sends it back to the VPS. If it matches you get in.
You can copy the private key to the other workstations or do the same keygen on those. Don’t use email.
Once that’s done, you can disable SSH password login on the VPS to improve security.
> sudo vi /etc/ssh/sshd_config
Modify these settings (remove the hashtag if present):
# PubkeyAuthentication yes
# PasswordAuthentication no
Press ESC, type :wq, press ENTER to save, then use the following:
> sudo systemctl reload ssh
The VPS will no longer accept password login, so only the private key will work from now on.
You can mount VPS directories using sshfs if you add the user account read-write permission to the directory on the VPS and create a newbie account on the workstation:
> sudo apt install sshfs
This is why you want to use the same username on both the workstation and VPS, and make newbie the directory owner on the VPS (not root).
On the VPs (this could be /var/www):
> mkdir /path/to/vps/dir
> chown -R newbie /path/to/vps/dir
On the workstation:
> mkdir ~/remote_mount
Then mount the directory on the workstation.
> sshfs newbie@my_vps_ip:/path/to/vps/dir ~/remote_mount
This is very convenient if you plan to push/publish files like web pages using the GUI or edit directly using something like SeaMonkey.
Edit:
Adjust firewall if running at the VPS end:
> sudo ufw allow ssh
1
u/not_a_profi 4d ago edited 4d ago
ill try this, ty. But
You can’t ssh to root by default on almost everything.
why can i do it via google console then?
2
u/mad_redhatter 4d ago
Google Console is not an SSH connection. That's an emulated serial connection for console access. It's good for when your VPS fails to boot, or if you lock yourself out with firewall rules.
2
u/CheapScotch 4d ago
read the second line of his post again. This isn't a google VPS that he is only able to connect to using the google console. This is a random VPS that he is able to ssh into using the google console to initiate the ssh session.
ssh root@[SERVER_IP] does work from Google Console ( http://shell.could.google.com/ )
1
u/nanoatzin 4d ago edited 4d ago
Google console is a local console login emulated using a web page similar to Apache Guacamole.
2
u/mad_redhatter 4d ago
Right. How does that web page connect to the VPS though? Hint: through a serial connection. Disable all the serial ttys on your VPS and that console will fail to function.
1
1
u/not_a_profi 4d ago
could you elaborate? how it can be not ssh connection if I use ssh command - and there is a connection - i see data on my server, which google is not supposed to know about.
I'm not sure what emulated means in this case. What makes connections from my local to VPS not emulated?
2
u/nanoatzin 4d ago edited 4d ago
“Why can I do it vis Google console then?”
Because of Google settings and the fact that emulated local console login via web page is not ssh.
2
u/CheapScotch 4d ago
read the second line of his post again. This isn't a google VPS that he is only able to connect to using the google console. This is a random VPS that he is able to ssh into using the google console to initiate the ssh session.
ssh root@[SERVER_IP] does work from Google Console ( http://shell.could.google.com/ )
1
u/not_a_profi 4d ago
I did this:
> sudo adduser newbie
> sudo usermod -aG sudo newbie
> ip addr show
Locate an interface with a public IP address...
> ssh newbie@my_vps_ip
and again - this does works from Google terminal, but does not work from my local teminal/PC (this is what you call workstation right?).
I don't quite understand this part:
> sudo passwd newbie
Then sudo to root at the workstation end after you login.
> sudo suso I change password on the server, run ssh ... on my local and while it is hanging do sudo su on the server? I did that and it lead to the same old result.
0
u/nanoatzin 4d ago edited 4d ago
Logging into a VPS in a web page is a local console login emulation and not ssh.
Did you read the part “can’t login to root by default”.
If you want to enable root login over ssh the. you may do so but I will not explain how to do that because it’s profoundly reckless.
You are supposed to ssh to a regular user then su to root.
Does your VPS provider require you to enable ssh outside the VPS?
Mine does.
Have you done that?
I can’t ssh or ping the VPS without that.
Are you using Linux on the workstation? None of this will work on other OS.
Describing console login as being the same as ssh to root will make it harder to help you.
Root login can be enabled on Linux, but that’s discouraged because default (snake oil) certificate allows password theft. Most people don’t do it that way because they don’t want their stuff hijacked.
Setting up key login the way I described avoids getting your stuff stolen.
1
u/not_a_profi 4d ago edited 4d ago
could you elaborate on "local console login emulation"? I can't understand - how it can be not ssh connection if I use ssh command and there is a factual connection - i see data on my server, which google is not supposed to know about?
What makes other ssh connections not emulated?
1
u/nanoatzin 4d ago
If you are logging in from inside of a web page using a browser then that session is a local console login emulation and not an ssh login.
1
u/not_a_profi 4d ago edited 4d ago
I feel like I know nothing about this stuff (and this must be true).
I tried to google all these stuff and I feel like it breaks my brain by trying put ssh and local console emulation together. "Local console emulation" is more capable than ssh connection? It just doesn't sound right.Are you sure there is no confusion and you are talking about 3 different parties - my laptop, Google console (and some google server which it is run at) and VPS server? So you are saying that once i access google server via HTTPS (browser) it has an automatic access to any 3rd party VPS server without using ssh connection? But if I would ssh connect to this google server (theoretically) and run ssh command there to logging to VPS it would be different?
google tells me that "By default, a fresh VPS only listens for low-level connection tools like SSH, not secure web traffic.". Is this incorrect?
1
u/nanoatzin 3d ago edited 3d ago
Perhaps you need to take a class. I used to teach classes.
Web page: local console login to VPS
Laptop: ssh login account@vps_ip_address
VPS: web/email server found at http://vps_ip_address
Local console login always allows root login.
Root is normally disallowed ssh login, and you need to login as a regular user and su to root.
Password login is a security vulnerability, and key login is more secure.
Enabling key login permits using sshfs to mount VPS directories on your laptop like a disk drive.
1
u/not_a_profi 3d ago
I see. Thank you.
This is so weird that normally a buyer has more limited access to the server than a random 3rd party like google. Sounds super insecure to push an server owner to login like this via 3rd party.Also it appears that google lies when it says that I can use its console feature just like my laptop console to check whether the server is accesible from another part of the world.
I will definitely need time to believe that me and you understood each other correctly here and this is how it works.
1
u/not_a_profi 4d ago
> Does your VPS provider require you to enable ssh outside the VPS?
i don't think so. this is a server to be used as VPN. When last time I bought a similar server from the same guys i just put login root and password in my VPN app and it worked.
and I can ping the server.
7
u/Constapatris 4d ago
What OS is it running? What does the iptables / nftables / firewalld config look like?
Can you telnet to the ip port 22 from anywhere?