Networking issue

Networking issue

[Adam Luchjenbroers]

I installed Mandrake 9.0 on a server box I'm putting together, I installed the 
firewall shorewall. Couldn't connect to the ssh server or even ping the box 
(the inability to ping it, I assumed was the result of shorewall).

Reconnected monitor and keyboard to server, server couldn't ping any of the 
other computers (sendmsg not permitted)

So I turned off shorewall and even removed it from startup, can now ping from 
the server to other computers but it cannot be pinged (even ping 127.0.0.1 
doesn't work) or connected to using ssh (sshd is running)

Any idea whats wrong?

-- 
"I had a letter in the post today. It said 'Gas Bill'. It sounds a tempting 
offer" - Alan Cox

Please avoid sending me Word or PowerPoint attachments.
See http://www.fsf.org/philosophy/no-word-attachments.html


-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Re: Networking issue

[Ray Olszewski]

Your report is way too sketchy to let anyone spot the problem. Post a 
followup with this information:

         1. Unedited output of "ifconfig -a"
         2. Unedited output of "netstat -nr'
         3. Unedited output of "iptables -nvL"
         4. An EXACT description of what the ping failures look like. (Does 
ping fail silently, or does it fail with an error message? If there's a 
message, what is it). Do this for (a) 127.0.0.1 pinged from the Mandrake 
host and (b) its eth0 IP address pinged from some other host (and mention 
what OS that host is running, since that affects the wording of ping error 
messages).
         5. The unedited output of 
"cat  /proc/sys/net/ipv4/icmp_echo_ignore_all"
         6. An EXACT description of what the ssh failures look like. 
Include info on how you run sshd (as a deamon by itself or through inetd), 
any error messages sshd logs, and how long you wait before deciding that 
sshd has failed (if you haven't been waiting for 5 minutes before giving 
up, please do so, so we can rule out DNS-related logging errors).

Do all of this WITHOUT installing Shorewall. Let's fix the problems one at 
a time ... get your basic conectivity working, then get the system properly 
firewalled. Oh, also mention what kernel version you are using ("uname -a") 
and whether you compiled it yourself or it is a stock Mandrake kernel.

At 07:06 PM 1/2/03 +0930, Adam Luchjenbroers wrote:

>I installed Mandrake 9.0 on a server box I'm putting together, I installed 
>the
>firewall shorewall. Couldn't connect to the ssh server or even ping the box
>(the inability to ping it, I assumed was the result of shorewall).
>
>Reconnected monitor and keyboard to server, server couldn't ping any of the
>other computers (sendmsg not permitted)
>
>So I turned off shorewall and even removed it from startup, can now ping from
>the server to other computers but it cannot be pinged (even ping 127.0.0.1
>doesn't work) or connected to using ssh (sshd is running)
>
>Any idea whats wrong?



--
-------------------------------------------"Never tell me the odds!"--------
Ray Olszewski					-- Han Solo
Palo Alto, California, USA			  ray@comarre.com
-------------------------------------------------------------------------------

-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Re: Networking issue

[Adam Luchjenbroers]

On Friday 03 Jan 2003 2:08 am, Ray Olszewski wrote:
> Your report is way too sketchy to let anyone spot the problem. Post a
> followup with this information:
>
>          1. Unedited output of "ifconfig -a"

eth0      Link encap:Ethernet  HWaddr 00:09:5B:1A:45:6D  
          inet addr:192.168.0.90  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST NOTRAILERS RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:527043 errors:0 dropped:0 overruns:0 frame:0
          TX packets:252053 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:763516605 (728.1 Mb)  TX bytes:16678999 (15.9 Mb)
          Interrupt:5 Base address:0x1000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:12 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1008 (1008.0 b)  TX bytes:1008 (1008.0 b)

>          2. Unedited output of "netstat -nr'

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.0.0     0.0.0.0         255.255.255.0   U        40 0          0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U        40 0          0 lo
0.0.0.0         192.168.0.1     0.0.0.0         UG       40 0          0 eth0

>          3. Unedited output of "iptables -nvL"

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               
destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               
destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               
destination


>          4. An EXACT description of what the ping failures look like. (Does
> ping fail silently, or does it fail with an error message? If there's a
> message, what is it). Do this for (a) 127.0.0.1 pinged from the Mandrake
> host and (b) its eth0 IP address pinged from some other host (and mention
> what OS that host is running, since that affects the wording of ping error
> messages).

No error messages, replies just don't get received

>          5. The unedited output of
> "cat  /proc/sys/net/ipv4/icmp_echo_ignore_all"

1

>          6. An EXACT description of what the ssh failures look like.
> Include info on how you run sshd (as a deamon by itself or through inetd),
> any error messages sshd logs, and how long you wait before deciding that
> sshd has failed (if you haven't been waiting for 5 minutes before giving
> up, please do so, so we can rule out DNS-related logging errors).

Default setup for Mandrake 9, how do I check?

I use gtelnet to connect from my workstation (it supports using ssh), it tries 
to connect but then fails. Oddly enough, http and ftp servers seem to work 
fine (only just tested them)

I want SSH so I don't have to use this second monitor and keyboard to do 
everything (messy)

> Do all of this WITHOUT installing Shorewall. Let's fix the problems one at
> a time ... get your basic conectivity working, then get the system properly
> firewalled. Oh, also mention what kernel version you are using ("uname -a")
> and whether you compiled it yourself or it is a stock Mandrake kernel.

Would be the stock Mandrake 9 kernel (2.4.19-16mdk)

-- 
"Unix is user-friendly. It just isn't promiscuous about which users it's 
friendly with." - Steven King

Please avoid sending me Word or PowerPoint attachments.
See http://www.fsf.org/philosophy/no-word-attachments.html


-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Re: Networking issue

[Ray Olszewski]

Ok, mystery solved. At least for the pings. Your system is set for some 
reason not to reply to pings (is this a Mandrake default? does anyone here 
know?). This is the relevant part:

> >          5. The unedited output of
> > "cat  /proc/sys/net/ipv4/icmp_echo_ignore_all"
>
>1

Since ping uses icmp echo and the "1" means the kernel is set to ignore 
this packet type, you get no ping responses. If you want to change (dare I 
say "fix"?) this, do it with

         echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all

(which you can add to an init file to do during the boot/init process).

As to the ssh problem ... whatever it is, it has a different cause, not 
this. I still don't know enough about what happens to help you here, but 
from the general stuff you provide, I'd say the problem is specific either 
to the sshd daemon on the Linux system or to the gtelnet client on whatever 
host you are using as a workstation (you forgot to mention what OS it 
runs). You write:

>I use gtelnet to connect from my workstation (it supports using ssh), it 
>tries
>to connect but then fails. Oddly enough, http and ftp servers seem to work
>fine (only just tested them)

I don't know getlnet ... from the "g", I'm guessing it is a Linux (GNU) 
app, but I don't even really know that. So let's try again, with a bit more 
detail.

1. What system is gtelnet running on?

2. When you say that "http and ftp servers seem to work", are you testing 
them *from* the same workstation on which ssh fails? If not, make sure the 
workstation has a proper interface setup and routing table (since I don't 
know its OS, I can't tell you how).

3. From the Mandrake system, can you ssh to localhost (or to 127.0.0.1)? If 
not, EXACTLY what error does the ssh client report? (If you don't have an 
ssh client installed, see what "telnet localhost 22" does. It should 
display the banner from the sshd daemon.)

4. When gtelnet "then fails", does it display any sort of error message? If 
you are interpreting no response as a failure, how long are you waiting?

5. In the ifconfig output you posted here, there are packet counts for RX 
and TX packets on each interface. After you try and fail to ssh from the 
wworkstation to the server, are the server's eth0 packet counts higher? If 
ssh'ing to localhost on the server also fails, the same question for its lo 
interface.

6. I'm assuming you are running sshd as a daemon and not through inetd. But 
let's check the basics here. So ...

         A. If you do a "ps ax | grep ssh", does sshd show up on the 
process list?
         B. If you do a "netstat -nl", does port 22 show up on the list? It 
will be a line something like this:
         tcp        0      0 0.0.0.0:22              0.0.0.0:*   LISTEN

7. After a failure, does sshd log anything? I'm not sure how Mandrake keeps 
its logs, but something like this should work (as root):

         grep sshd /var/log/*

8. Finally, do you have anything in your configuration that blocks ssh 
connects from this workstation? Are there any relevant entries in 
/etc/hosts.deny?

There are probably more things to check, but this set is a good start.

At 12:45 PM 1/3/03 +0930, Adam Luchjenbroers wrote:
>On Friday 03 Jan 2003 2:08 am, Ray Olszewski wrote:
> > Your report is way too sketchy to let anyone spot the problem. Post a
> > followup with this information:
> >
> >          1. Unedited output of "ifconfig -a"
>
>eth0      Link encap:Ethernet  HWaddr 00:09:5B:1A:45:6D
>           inet addr:192.168.0.90  Bcast:192.168.0.255  Mask:255.255.255.0
>           UP BROADCAST NOTRAILERS RUNNING MULTICAST  MTU:1500  Metric:1
>           RX packets:527043 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:252053 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:100
>           RX bytes:763516605 (728.1 Mb)  TX bytes:16678999 (15.9 Mb)
>           Interrupt:5 Base address:0x1000
>
>lo        Link encap:Local Loopback
>           inet addr:127.0.0.1  Mask:255.0.0.0
>           UP LOOPBACK RUNNING  MTU:16436  Metric:1
>           RX packets:12 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:0
>           RX bytes:1008 (1008.0 b)  TX bytes:1008 (1008.0 b)
>
> >          2. Unedited output of "netstat -nr'
>
>Kernel IP routing table
>Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
>192.168.0.0     0.0.0.0         255.255.255.0   U        40 0          0 eth0
>127.0.0.0       0.0.0.0         255.0.0.0       U        40 0          0 lo
>0.0.0.0         192.168.0.1     0.0.0.0         UG       40 0          0 eth0
>
> >          3. Unedited output of "iptables -nvL"
>
>Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
>  pkts bytes target     prot opt in     out     source
>destination
>
>Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
>  pkts bytes target     prot opt in     out     source
>destination
>
>Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
>  pkts bytes target     prot opt in     out     source
>destination
>
>
> >          4. An EXACT description of what the ping failures look like. (Does
> > ping fail silently, or does it fail with an error message? If there's a
> > message, what is it). Do this for (a) 127.0.0.1 pinged from the Mandrake
> > host and (b) its eth0 IP address pinged from some other host (and mention
> > what OS that host is running, since that affects the wording of ping error
> > messages).
>
>No error messages, replies just don't get received
>
> >          5. The unedited output of
> > "cat  /proc/sys/net/ipv4/icmp_echo_ignore_all"
>
>1
>
> >          6. An EXACT description of what the ssh failures look like.
> > Include info on how you run sshd (as a deamon by itself or through inetd),
> > any error messages sshd logs, and how long you wait before deciding that
> > sshd has failed (if you haven't been waiting for 5 minutes before giving
> > up, please do so, so we can rule out DNS-related logging errors).
>
>Default setup for Mandrake 9, how do I check?
>
>I use gtelnet to connect from my workstation (it supports using ssh), it 
>tries
>to connect but then fails. Oddly enough, http and ftp servers seem to work
>fine (only just tested them)
>
>I want SSH so I don't have to use this second monitor and keyboard to do
>everything (messy)
>
> > Do all of this WITHOUT installing Shorewall. Let's fix the problems one at
> > a time ... get your basic conectivity working, then get the system properly
> > firewalled. Oh, also mention what kernel version you are using ("uname -a")
> > and whether you compiled it yourself or it is a stock Mandrake kernel.
>
>Would be the stock Mandrake 9 kernel (2.4.19-16mdk)


--
-------------------------------------------"Never tell me the odds!"--------
Ray Olszewski					-- Han Solo
Palo Alto, California, USA			  ray@comarre.com
-------------------------------------------------------------------------------

-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Re: Networking issue

[glenn]

On Fri, 03 Jan 2003 5:24 pm, Ray Olszewski wrote:
> Ok, mystery solved. At least for the pings. Your system is set for some
> reason not to reply to pings (is this a Mandrake default? does anyone here
>

Mandrake runs a batch of scripts under the name of msec which maintins a 
particular security level (1-6 i think). This can be configured through 
'Mandrake Control Center' under security. If the level is set too high then 
the default permisions will prevent normal internet connectivity as designed 
for server use. Adjust to a lower level as per the instruction in the 
Mandrake 'Control Center'. You will need root access to do this.

msec pereodically runs and if it finds anything at odds with its permision 
levels then they are reset back.
-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Re: Networking issue

[Adam Luchjenbroers]

> Mandrake runs a batch of scripts under the name of msec which maintins a
> particular security level (1-6 i think). This can be configured through
> 'Mandrake Control Center' under security. If the level is set too high then
> the default permisions will prevent normal internet connectivity as
> designed for server use. Adjust to a lower level as per the instruction in
> the Mandrake 'Control Center'. You will need root access to do this.

Cool, but how do I reconfigure it without using a GUI (GUI was not installed 
on server as I didn't consider it necessary)

Alternatively, I might just take msec out of crons list.

-- 
"Microsoft is a cross between the Borg and the Ferengi. Unfortunately, they 
use Borg to do their marketing and Ferengi to do their programming." - Simon 
Slavin

Please avoid sending me Word or PowerPoint attachments.
See http://www.fsf.org/philosophy/no-word-attachments.html


-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Re: Networking issue

[Adam Luchjenbroers]

> 1. What system is gtelnet running on?

Workstation, running mandrake 9.0

> 3. From the Mandrake system, can you ssh to localhost (or to 127.0.0.1)? If
> not, EXACTLY what error does the ssh client report? (If you don't have an
> ssh client installed, see what "telnet localhost 22" does. It should
> display the banner from the sshd daemon.)

Its a very minimal install on the server, it has neither ssh or telnet
 clients

> 4. When gtelnet "then fails", does it display any sort of error message? If
> you are interpreting no response as a failure, how long are you waiting?

I wait until the status display goes from displaying "connected" until it
 goes to "not connected"

tried to connect using the ssh command, got this error

ssh_exchange_identification: Connection closed by remote host

> 5. In the ifconfig output you posted here, there are packet counts for RX
> and TX packets on each interface. After you try and fail to ssh from the
> wworkstation to the server, are the server's eth0 packet counts higher? If
> ssh'ing to localhost on the server also fails, the same question for its lo
> interface.

RX/TX values do increase.

> 6. I'm assuming you are running sshd as a daemon and not through inetd. But
> let's check the basics here. So ...
>
>          A. If you do a "ps ax | grep ssh", does sshd show up on the
> process list?

yes

>          B. If you do a "netstat -nl", does port 22 show up on the list? It
> will be a line something like this:
>          tcp        0      0 0.0.0.0:22              0.0.0.0:*   LISTEN

yes

> 7. After a failure, does sshd log anything? I'm not sure how Mandrake keeps
> its logs, but something like this should work (as root):
>
>          grep sshd /var/log/*

log files are stored there, but can't tell which one belongs to ssh

> 8. Finally, do you have anything in your configuration that blocks ssh
> connects from this workstation? Are there any relevant entries in
> /etc/hosts.deny?

no

> There are probably more things to check, but this set is a good start.

On another note, I corrected the system clock on tthe server (it thought it
was 1998) now one of my user accounts has expired, how do I reactiveate it.

--
"You can bring any calculator you like to the midterm, as long as it doesn't
dim the lights when you turn it on." - Hepler, Systems Design 182

Please avoid sending me Word or PowerPoint attachments.
See http://www.fsf.org/philosophy/no-word-attachments.html

-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Re: Networking issue

[Ray Olszewski]

At 02:57 PM 1/3/03 +0930, Adam Luchjenbroers wrote:
[...]
> > 4. When gtelnet "then fails", does it display any sort of error message? If
> > you are interpreting no response as a failure, how long are you waiting?
>
>I wait until the status display goes from displaying "connected" until it
>  goes to "not connected"
>
>tried to connect using the ssh command, got this error
>
>ssh_exchange_identification: Connection closed by remote host

This (combined with other details of your reply, omitted here) suggests 
that the problem is authentication. How do you have sshd set to expect 
connections to authenticate? (The choices are in sshd's config file, 
probably /etc/ssh/sshd_conf .) How do you have gtelnet set to attempt to 
authenticate (I'm not familiar with this client so can't tell you how to 
check this)?

[...]
>On another note, I corrected the system clock on tthe server (it thought it
>was 1998) now one of my user accounts has expired, how do I reactiveate it.

Accounts don't normally expire, so either I am misunderstanding your 
description or you are using something peculiar to Mandrake 9.0. In either 
case, I need to leave it to someone else to help with this one.



--
-------------------------------------------"Never tell me the odds!"--------
Ray Olszewski					-- Han Solo
Palo Alto, California, USA			  ray@comarre.com
-------------------------------------------------------------------------------

-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Re: Networking issue

[Adam Luchjenbroers]

On Friday 03 Jan 2003 4:39 pm, Ray Olszewski wrote:

Got everything pretty much fixed, except for one thing.

Something perioically seems to re-add a line to hosts.deny that forbids 
connections from everything but localhost. 
/proc/sys/net/ipv4/icmp_echo_ignore_all also gets reset to 1 (but this 
happened at a different time)

/var/spool/cron has no entries

How can I find the problem?

-- 
"MS-DOS is to computing as the black plague was to Europe" - NH

Please avoid sending me Word or PowerPoint attachments.
See http://www.fsf.org/philosophy/no-word-attachments.html


-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Re: Networking issue

[Ray Olszewski]

At 09:01 PM 1/3/03 +0930, Adam Luchjenbroers wrote:
>On Friday 03 Jan 2003 4:39 pm, Ray Olszewski wrote:
>
>Got everything pretty much fixed, except for one thing.
>
>Something perioically seems to re-add a line to hosts.deny that forbids
>connections from everything but localhost.
>/proc/sys/net/ipv4/icmp_echo_ignore_all also gets reset to 1 (but this
>happened at a different time)
>
>/var/spool/cron has no entries

I infer (from the comment about cron) that these changes occur while the 
server is running, rather than as the result of a reboot. And when you say 
"/var/spool/cron has no entries", I understand you to mean that it does not 
have the usual subdirectories (since /var/spool/cron is a directory, not a 
file). Beyond that ... you'd get better help from someone who uses Mandrake 
than from a Debian user like me, since this behavior most likely reflects 
something idiosyncratic to Mandrake.

So ... all I can offer is some reflection on how I'd try to investigate an 
unknown problem of this sort. Putting aside obvious things like a Google 
search,  I'd first try to ping down "periodically" to a more precise value.

When you discover the change in /etc/hosts.deny, what is the timestamp on 
the file?

Look through your process list and see if there is some daemon running that 
might do things like this. Have you installed a firewall package (though 
I'd be astounded if Shorewall, the one you mentioned trying, did anything 
this silly ... it is a well-designed app)?

Might one of the other cron-job files (the ones in /etc) be running 
something that makes these changes?

For example, is something running one of your init scripts with the 
"restart" switch? Check (using "grep") all the init scripts (does Mandrake 
keep these in /etc/init.d or somewhere else?) for any references to 
hosts.deny or "icmp_echo".

That's about all I can think of for starters.


--
-------------------------------------------"Never tell me the odds!"--------
Ray Olszewski					-- Han Solo
Palo Alto, California, USA			  ray@comarre.com
-------------------------------------------------------------------------------

-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs