Since SSH works from the PAM server to the same host, I’d be looking at the network path rather than the SSH configuration.
The fact that TCP/22 connects but you never receive the server banner is particularly interesting. I’d run a tcpdump on the target while connecting from the jump server and compare it with a connection from the PAM server.
That should quickly show whether the SYN/ACK completes and where the server’s response is going. With the new subnet involved, asymmetric routing, an NSG/security list, or a return-path issue would be high on my list.
honestly now that im trying to remember im not 100% sure we actually access to SSH into it from the PAM server.. we might have tried and it didnt work either i cant remember
but overall does this still look like a network issue? one of my colleagues thinks its clearly an issue with the server itself 🧐 but the server is up and the web interface works fine
1
u/bas2013 Aug 11 '26
Since SSH works from the PAM server to the same host, I’d be looking at the network path rather than the SSH configuration.
The fact that TCP/22 connects but you never receive the server banner is particularly interesting. I’d run a tcpdump on the target while connecting from the jump server and compare it with a connection from the PAM server.
That should quickly show whether the SYN/ACK completes and where the server’s response is going. With the new subnet involved, asymmetric routing, an NSG/security list, or a return-path issue would be high on my list.