SSH connection failure: processing of forwarded request fails on known_host key
up vote
0
down vote
favorite
When I attempt a SSH connection between client C and server S (both on the same LAN) the client looks up the server's key in the client user's known_hosts file.
In the usual case for connection attempts, if the server's key is not found, the client is prompted to accept the server's key into the user's known_hosts file . If the key is found then the connection process continues.
However I have a situation where if the connection request is forwarded through the LAN router/modem the lookup for the server's key fails even though the target server's key is there, and the client is not prompted. Instead the attempt is refused with Connection reset by <IP of router>
Connect success to the LAN host directly using :
ssh -vvv stephen@acer
Connect failing to the LAN router to forward to acer using:
ssh -vvv stephen@michigan
This has just started happening. Any idea why?
Is the server key altered by the router?
Is the router replacing the target server's key with its own?
Is there some way of getting a look at the key that's being passed. I am calling with
ssh -vvvhave the SSH logging set toVERBOSEbut see nothing I recognize as useful
System info:
Server host Ubuntu 18.04: Openssh-server/bionic-updates,bionic-security,now 1:7.6p1-4ubuntu0.1 amd64
Tested with clients:
- Ubuntu 18.10: openssh-client/cosmic,now 1:7.7p1-4 amd64
- Ubuntu 18.04: openssh-client/bionic-updates,bionic-security,now 1:7.6p1-4ubuntu0.1 amd64
- Debian 9.5: openssh-client/stable,now 1:7.4p1-10+deb9u4 amd64
Modem: Arris Xb6
Update to: SSH forwarded through modem recently started failing: update
openssh port-forwarding
asked Nov 24 at 19:53
Stephen Boston
1848
|
show 11 more comments
up vote
0
down vote
favorite
When I attempt a SSH connection between client C and server S (both on the same LAN) the client looks up the server's key in the client user's known_hosts file.
In the usual case for connection attempts, if the server's key is not found, the client is prompted to accept the server's key into the user's known_hosts file . If the key is found then the connection process continues.
However I have a situation where if the connection request is forwarded through the LAN router/modem the lookup for the server's key fails even though the target server's key is there, and the client is not prompted. Instead the attempt is refused with Connection reset by <IP of router>
Connect success to the LAN host directly using :
ssh -vvv stephen@acer
Connect failing to the LAN router to forward to acer using:
ssh -vvv stephen@michigan
This has just started happening. Any idea why?
Is the server key altered by the router?
Is the router replacing the target server's key with its own?
Is there some way of getting a look at the key that's being passed. I am calling with
ssh -vvvhave the SSH logging set toVERBOSEbut see nothing I recognize as useful
System info:
Server host Ubuntu 18.04: Openssh-server/bionic-updates,bionic-security,now 1:7.6p1-4ubuntu0.1 amd64
Tested with clients:
- Ubuntu 18.10: openssh-client/cosmic,now 1:7.7p1-4 amd64
- Ubuntu 18.04: openssh-client/bionic-updates,bionic-security,now 1:7.6p1-4ubuntu0.1 amd64
- Debian 9.5: openssh-client/stable,now 1:7.4p1-10+deb9u4 amd64
Modem: Arris Xb6
Update to: SSH forwarded through modem recently started failing: update
openssh port-forwarding
asked Nov 24 at 19:53
Stephen Boston
1848
What does the ssh command you are passing look like?
– Michael Prokopec
Nov 24 at 21:04
@MichaelProkopec I have added the commands to the question. Thank you.
– Stephen Boston
Nov 24 at 23:40
You say forwarding to acer, are you saying that you are outside the LAN at that point.
– Michael Prokopec
Nov 24 at 23:48
@MichaelProkopec No For both those requests, I am inside the LAN on another host i.e. a host other than acer (hostname vaio). I don't think this is a loopback problem because I can access other services on acer in this way. SSH is the only service that has given me connection problems this far.
– Stephen Boston
Nov 25 at 0:02
1
Check out rui's post: serverfault.com/questions/210408/…
– Michael Prokopec
Nov 25 at 0:09
|
show 11 more comments
up vote
0
down vote
favorite
up vote
0
down vote
favorite
When I attempt a SSH connection between client C and server S (both on the same LAN) the client looks up the server's key in the client user's known_hosts file.
In the usual case for connection attempts, if the server's key is not found, the client is prompted to accept the server's key into the user's known_hosts file . If the key is found then the connection process continues.
However I have a situation where if the connection request is forwarded through the LAN router/modem the lookup for the server's key fails even though the target server's key is there, and the client is not prompted. Instead the attempt is refused with Connection reset by <IP of router>
Connect success to the LAN host directly using :
ssh -vvv stephen@acer
Connect failing to the LAN router to forward to acer using:
ssh -vvv stephen@michigan
This has just started happening. Any idea why?
Is the server key altered by the router?
Is the router replacing the target server's key with its own?
Is there some way of getting a look at the key that's being passed. I am calling with
ssh -vvvhave the SSH logging set toVERBOSEbut see nothing I recognize as useful
System info:
Server host Ubuntu 18.04: Openssh-server/bionic-updates,bionic-security,now 1:7.6p1-4ubuntu0.1 amd64
Tested with clients:
- Ubuntu 18.10: openssh-client/cosmic,now 1:7.7p1-4 amd64
- Ubuntu 18.04: openssh-client/bionic-updates,bionic-security,now 1:7.6p1-4ubuntu0.1 amd64
- Debian 9.5: openssh-client/stable,now 1:7.4p1-10+deb9u4 amd64
Modem: Arris Xb6
Update to: SSH forwarded through modem recently started failing: update
openssh port-forwarding
asked Nov 24 at 19:53
Stephen Boston
1848
When I attempt a SSH connection between client C and server S (both on the same LAN) the client looks up the server's key in the client user's known_hosts file.
In the usual case for connection attempts, if the server's key is not found, the client is prompted to accept the server's key into the user's known_hosts file . If the key is found then the connection process continues.
However I have a situation where if the connection request is forwarded through the LAN router/modem the lookup for the server's key fails even though the target server's key is there, and the client is not prompted. Instead the attempt is refused with Connection reset by <IP of router>
Connect success to the LAN host directly using :
ssh -vvv stephen@acer
Connect failing to the LAN router to forward to acer using:
ssh -vvv stephen@michigan
This has just started happening. Any idea why?
Is the server key altered by the router?
Is the router replacing the target server's key with its own?
Is there some way of getting a look at the key that's being passed. I am calling with
ssh -vvvhave the SSH logging set toVERBOSEbut see nothing I recognize as useful
System info:
Server host Ubuntu 18.04: Openssh-server/bionic-updates,bionic-security,now 1:7.6p1-4ubuntu0.1 amd64
Tested with clients:
- Ubuntu 18.10: openssh-client/cosmic,now 1:7.7p1-4 amd64
- Ubuntu 18.04: openssh-client/bionic-updates,bionic-security,now 1:7.6p1-4ubuntu0.1 amd64
- Debian 9.5: openssh-client/stable,now 1:7.4p1-10+deb9u4 amd64
Modem: Arris Xb6
Update to: SSH forwarded through modem recently started failing: update
openssh port-forwarding
openssh port-forwarding
asked Nov 24 at 19:53
Stephen Boston
1848
asked Nov 24 at 19:53
Stephen Boston
1848
edited Nov 24 at 23:39
asked Nov 24 at 19:53
Stephen Boston
1848
asked Nov 24 at 19:53
Stephen Boston
1848
asked Nov 24 at 19:53
Stephen Boston
1848
1848
What does the ssh command you are passing look like?
– Michael Prokopec
Nov 24 at 21:04
@MichaelProkopec I have added the commands to the question. Thank you.
– Stephen Boston
Nov 24 at 23:40
You say forwarding to acer, are you saying that you are outside the LAN at that point.
– Michael Prokopec
Nov 24 at 23:48
@MichaelProkopec No For both those requests, I am inside the LAN on another host i.e. a host other than acer (hostname vaio). I don't think this is a loopback problem because I can access other services on acer in this way. SSH is the only service that has given me connection problems this far.
– Stephen Boston
Nov 25 at 0:02
1
Check out rui's post: serverfault.com/questions/210408/…
– Michael Prokopec
Nov 25 at 0:09
|
show 11 more comments
What does the ssh command you are passing look like?
– Michael Prokopec
Nov 24 at 21:04
@MichaelProkopec I have added the commands to the question. Thank you.
– Stephen Boston
Nov 24 at 23:40
You say forwarding to acer, are you saying that you are outside the LAN at that point.
– Michael Prokopec
Nov 24 at 23:48
@MichaelProkopec No For both those requests, I am inside the LAN on another host i.e. a host other than acer (hostname vaio). I don't think this is a loopback problem because I can access other services on acer in this way. SSH is the only service that has given me connection problems this far.
– Stephen Boston
Nov 25 at 0:02
1
Check out rui's post: serverfault.com/questions/210408/…
– Michael Prokopec
Nov 25 at 0:09
What does the ssh command you are passing look like?
– Michael Prokopec
Nov 24 at 21:04
What does the ssh command you are passing look like?
– Michael Prokopec
Nov 24 at 21:04
@MichaelProkopec I have added the commands to the question. Thank you.
– Stephen Boston
Nov 24 at 23:40
@MichaelProkopec I have added the commands to the question. Thank you.
– Stephen Boston
Nov 24 at 23:40
You say forwarding to acer, are you saying that you are outside the LAN at that point.
– Michael Prokopec
Nov 24 at 23:48
You say forwarding to acer, are you saying that you are outside the LAN at that point.
– Michael Prokopec
Nov 24 at 23:48
@MichaelProkopec No For both those requests, I am inside the LAN on another host i.e. a host other than acer (hostname vaio). I don't think this is a loopback problem because I can access other services on acer in this way. SSH is the only service that has given me connection problems this far.
– Stephen Boston
Nov 25 at 0:02
@MichaelProkopec No For both those requests, I am inside the LAN on another host i.e. a host other than acer (hostname vaio). I don't think this is a loopback problem because I can access other services on acer in this way. SSH is the only service that has given me connection problems this far.
– Stephen Boston
Nov 25 at 0:02
1
1
Check out rui's post: serverfault.com/questions/210408/…
– Michael Prokopec
Nov 25 at 0:09
Check out rui's post: serverfault.com/questions/210408/…
– Michael Prokopec
Nov 25 at 0:09
|
show 11 more comments
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f483915%2fssh-connection-failure-processing-of-forwarded-request-fails-on-known-host-key%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What does the ssh command you are passing look like?
– Michael Prokopec
Nov 24 at 21:04
@MichaelProkopec I have added the commands to the question. Thank you.
– Stephen Boston
Nov 24 at 23:40
You say forwarding to acer, are you saying that you are outside the LAN at that point.
– Michael Prokopec
Nov 24 at 23:48
@MichaelProkopec No For both those requests, I am inside the LAN on another host i.e. a host other than acer (hostname vaio). I don't think this is a loopback problem because I can access other services on acer in this way. SSH is the only service that has given me connection problems this far.
– Stephen Boston
Nov 25 at 0:02
1
Check out rui's post: serverfault.com/questions/210408/…
– Michael Prokopec
Nov 25 at 0:09