ssh-keyscan returns empty output, when executed several times
up vote
0
down vote
favorite
I played around with ssh and found an interesting (maybe intended) behavior.
I have 3 hosts: Machine A, B and C. I am using ssh to access C from A or B.
- ssh from A to C - works
- ssh from B to C - works
- On A: Execute ssh-keyscan -Ht rsa C_ip_address couple of times (4) serially, returns me the public key correctly. But when I execute it for the next time, it returns empty output and I cannot ssh to C from A anymore, get only connection timed out as a response.
- On B: I can still ssh to C. But when I do the same as in step 3, I am not able to ssh to C anymore.
Telnet returns time out as well.
If I want to ssh to C from A or B again, I have to restart C (C will change the IP address).
Does this mean that, C puts A and B on some blacklist, because of some suspicion of a malicious intent ?
Note: I did the serial execution of ssh-keyscan in ca 3 minutes.
ssh
asked 2 days ago
FilipR
1011
New contributor
FilipR is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
up vote
0
down vote
favorite
I played around with ssh and found an interesting (maybe intended) behavior.
I have 3 hosts: Machine A, B and C. I am using ssh to access C from A or B.
- ssh from A to C - works
- ssh from B to C - works
- On A: Execute ssh-keyscan -Ht rsa C_ip_address couple of times (4) serially, returns me the public key correctly. But when I execute it for the next time, it returns empty output and I cannot ssh to C from A anymore, get only connection timed out as a response.
- On B: I can still ssh to C. But when I do the same as in step 3, I am not able to ssh to C anymore.
Telnet returns time out as well.
If I want to ssh to C from A or B again, I have to restart C (C will change the IP address).
Does this mean that, C puts A and B on some blacklist, because of some suspicion of a malicious intent ?
Note: I did the serial execution of ssh-keyscan in ca 3 minutes.
ssh
asked 2 days ago
FilipR
1011
New contributor
FilipR is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1
This looks like the type of behaviourfail2banand similar products will do; 4 failed login attempts from an IP causes it to be banned for a while. You might see it iniptables -Loutput.
– Stephen Harris
2 days ago
@StephenHarris You are right, there is anChain sshguard (1 references) target prot opt source destination DROP all -- 51.28.205.35.bc.googleusercontent.com anywhere entry in the iptables. Thank you for your explanation.
– FilipR
2 days ago
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I played around with ssh and found an interesting (maybe intended) behavior.
I have 3 hosts: Machine A, B and C. I am using ssh to access C from A or B.
- ssh from A to C - works
- ssh from B to C - works
- On A: Execute ssh-keyscan -Ht rsa C_ip_address couple of times (4) serially, returns me the public key correctly. But when I execute it for the next time, it returns empty output and I cannot ssh to C from A anymore, get only connection timed out as a response.
- On B: I can still ssh to C. But when I do the same as in step 3, I am not able to ssh to C anymore.
Telnet returns time out as well.
If I want to ssh to C from A or B again, I have to restart C (C will change the IP address).
Does this mean that, C puts A and B on some blacklist, because of some suspicion of a malicious intent ?
Note: I did the serial execution of ssh-keyscan in ca 3 minutes.
ssh
asked 2 days ago
FilipR
1011
New contributor
FilipR is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I played around with ssh and found an interesting (maybe intended) behavior.
I have 3 hosts: Machine A, B and C. I am using ssh to access C from A or B.
- ssh from A to C - works
- ssh from B to C - works
- On A: Execute ssh-keyscan -Ht rsa C_ip_address couple of times (4) serially, returns me the public key correctly. But when I execute it for the next time, it returns empty output and I cannot ssh to C from A anymore, get only connection timed out as a response.
- On B: I can still ssh to C. But when I do the same as in step 3, I am not able to ssh to C anymore.
Telnet returns time out as well.
If I want to ssh to C from A or B again, I have to restart C (C will change the IP address).
Does this mean that, C puts A and B on some blacklist, because of some suspicion of a malicious intent ?
Note: I did the serial execution of ssh-keyscan in ca 3 minutes.
ssh
ssh
asked 2 days ago
FilipR
1011
New contributor
FilipR is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 2 days ago
FilipR
1011
New contributor
FilipR is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 2 days ago
FilipR
1011
New contributor
FilipR is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 2 days ago
FilipR
1011
asked 2 days ago
FilipR
1011
1011
New contributor
FilipR is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
FilipR is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
FilipR is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1
This looks like the type of behaviourfail2banand similar products will do; 4 failed login attempts from an IP causes it to be banned for a while. You might see it iniptables -Loutput.
– Stephen Harris
2 days ago
@StephenHarris You are right, there is anChain sshguard (1 references) target prot opt source destination DROP all -- 51.28.205.35.bc.googleusercontent.com anywhere entry in the iptables. Thank you for your explanation.
– FilipR
2 days ago
add a comment |
1
This looks like the type of behaviourfail2banand similar products will do; 4 failed login attempts from an IP causes it to be banned for a while. You might see it iniptables -Loutput.
– Stephen Harris
2 days ago
@StephenHarris You are right, there is anChain sshguard (1 references) target prot opt source destination DROP all -- 51.28.205.35.bc.googleusercontent.com anywhere entry in the iptables. Thank you for your explanation.
– FilipR
2 days ago
1
1
This looks like the type of behaviour
fail2ban and similar products will do; 4 failed login attempts from an IP causes it to be banned for a while. You might see it in iptables -L output.– Stephen Harris
2 days ago
This looks like the type of behaviour
fail2ban and similar products will do; 4 failed login attempts from an IP causes it to be banned for a while. You might see it in iptables -L output.– Stephen Harris
2 days ago
@StephenHarris You are right, there is an
Chain sshguard (1 references) target prot opt source destination DROP all -- 51.28.205.35.bc.googleusercontent.com anywhere entry in the iptables. Thank you for your explanation.– FilipR
2 days ago
@StephenHarris You are right, there is an
Chain sshguard (1 references) target prot opt source destination DROP all -- 51.28.205.35.bc.googleusercontent.com anywhere entry in the iptables. Thank you for your explanation.– FilipR
2 days ago
add a comment |
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
FilipR is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f487678%2fssh-keyscan-returns-empty-output-when-executed-several-times%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
FilipR is a new contributor. Be nice, and check out our Code of Conduct.
FilipR is a new contributor. Be nice, and check out our Code of Conduct.
FilipR is a new contributor. Be nice, and check out our Code of Conduct.
FilipR is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f487678%2fssh-keyscan-returns-empty-output-when-executed-several-times%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
This looks like the type of behaviour
fail2banand similar products will do; 4 failed login attempts from an IP causes it to be banned for a while. You might see it iniptables -Loutput.– Stephen Harris
2 days ago
@StephenHarris You are right, there is an
Chain sshguard (1 references) target prot opt source destination DROP all -- 51.28.205.35.bc.googleusercontent.com anywhere entry in the iptables. Thank you for your explanation.– FilipR
2 days ago