can ssh to localhost, other machines but not 127.0.0.1 or IP address

Question

can ssh to localhost, other machines but not 127.0.0.1 or IP address

The subject says the it all: when I turn on Remote Login, I am able to login to 'localhost', other boxes but unable to log in remotely or to '127.0.0.1'. Here is more detailed information:

$ ssh localhost
Password:
Last login: Wed Feb 23 12:24:40 2011
$

# I can also login to another Mac on my local network:
$ ssh 192.168.0.5
Password:
Last login: Wed Feb 23 11:26:02 2011 from localhost
$

# However, I receive the following when I do:
$ ssh 127.0.0.1 -v -v -v
OpenSSH_5.2p1, OpenSSL 0.9.8l 5 Nov 2009
debug1: Reading configuration data /etc/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to 127.0.0.1 [127.0.0.1] port 22.

# at which point it hangs until timeout.

Any ideas?

MacBook Pro, Mac OS X (10.6.6)

Posted on Feb 23, 2011 10:30 AM

Reply

Answer 1

Feb 23, 2011 10:38 AM in response to Jeff in Madison

Do you have the firewall enabled? Any 3rd party security software running? What happens if you do

telnet 127.0.0.1 22

Reply

Answer 2

Feb 23, 2011 10:42 AM in response to Jeff in Madison

Jeff,

what output does the following command produce?


(echo localhost ; echo 127.0.0.1) | nslookup

Reply

Answer 3

gbullman

Level 2

316 points

Feb 23, 2011 10:44 AM in response to Jeff in Madison

I can't duplicate your results. I can ssh to either localhost or 127.0.0.1 with pretty much the same behavior (successful login after accepting the RSA key fingerprint).

Your issue appears to be trying to connect to http://127.0.0.1 port 22 compared to what I get;

$ ssh 127.0.0.1 -v -v
OpenSSH_5.2p1, OpenSSL 0.9.8l 5 Nov 2009
debug1: Reading configuration data /etc/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to 127.0.0.1 [127.0.0.1] port 22.
debug1: Connection established.

You have any sort of non-standard DNS set up?

Also, you might have better luck posting this in the Mac OS X Technologies / UNIX discussions since this is really an under the covers kind of issue.

Reply

Answer 4

Feb 23, 2011 11:02 AM in response to Pete Corelio

On the problem laptop, I see this:

$ telnet 127.0.0.1 22
Trying 127.0.0.1...

until it timesout. On the working box, I get the following:

$ telnet 127.0.0.1 22
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.2

Reply

Answer 5

Feb 23, 2011 11:05 AM in response to Baumkartoffel

On my nonworking box, I see approximately what I see on the working box. Here is output of both:

From the non-working box:

$ (echo localhost ; echo 127.0.0.1) | nslookup

;; Got recursion not available from 192.168.0.1, trying next server

Server: 216.165.129.158
Address: 216.165.129.158#53

Non-authoritative answer:
Name: localhost
Address: 127.0.0.1

;; Got recursion not available from 192.168.0.1, trying next server

Server: 216.165.129.158
Address: 216.165.129.158#53

Non-authoritative answer:
1.0.0.127.in-addr.arpa name = localhost.

Authoritative answers can be found from:

On the working box, I see:
$ (echo localhost ; echo 127.0.0.1) | nslookup

;; Got recursion not available from 192.168.0.1, trying next server

Server: 216.165.129.158
Address: 216.165.129.158#53

Non-authoritative answer:
Name: localhost
Address: 127.0.0.1

;; Got recursion not available from 192.168.0.1, trying next server

Server: 216.165.129.158
Address: 216.165.129.158#53

Non-authoritative answer:
1.0.0.127.in-addr.arpa name = localhost.

Authoritative answers can be found from:

Reply

Answer 6

Feb 23, 2011 11:13 AM in response to gbullman

Okay - thanks. I'll try posting there as well.

I don't have any third-party stuff running; my firewall is off. I did install macports and the openssh they use, though all that stuff lives under /opt/.

FWIW, I found on google a suggestion that the following might help diagnose things:

$ sudo lsof -i -P | grep 22
Password:
launchd 1 root 96u IPv6 0x0d940bb0 0t0 TCP *:22 (LISTEN)
launchd 1 root 99u IPv4 0x10b46abc 0t0 TCP *:22 (LISTEN)

However, launchd is out of my comfort zone.
--Jeff

Reply

Answer 7

Linc Davis

Level 10

209,739 points

Feb 23, 2011 11:14 AM in response to Jeff in Madison

Edit the file ~/.ssh/known_hosts to remove any lines that begin with '127.0.0.1'.

If that doesn't help, please post any messages from secure.log or system.log that refer to 'sshd' when you try to log in.

Reply

Answer 8

Feb 23, 2011 11:37 AM in response to Linc Davis

known_hosts has no 127.0.0.1 lines.

Two different commands, two different results:
$ ssh 127.0.0.1
produces no new output using 'tail -f /var/log/system.log'

However, the successful command
$ ssh localhost
Password:
Last login: Wed Feb 23 13:32:05 2011 from localhost
ph-jeffkline-l01:~ kline$

results in the following output in the system.log file
...
Feb 23 13:32:38 ph-jeffkline-l01 sandboxd[591]: sshd(589) deny mach-per-user-lookup
Feb 23 13:32:49: --- last message repeated 8 times ---
Feb 23 13:32:49 ph-jeffkline-l01 sshd[588]: USER_PROCESS: 592 ttys004
...

Reply

Answer 9

Linc Davis

Level 10

209,739 points

Feb 23, 2011 11:47 AM in response to Jeff in Madison

What about secure.log?

Reply

Answer 10

Feb 23, 2011 12:10 PM in response to Linc Davis

Nothing using 'ssh 127.0.0.1'. However using 'ssh localhost' we see some stuff:

Feb 23 14:08:49 ph-jeffkline-l01 sshd[714]: Connection from ::1 port 50564
Feb 23 14:08:49 ph-jeffkline-l01 sshd[714]: Failed publickey for kline from ::1 port 50564 ssh2
Feb 23 14:08:49 ph-jeffkline-l01 sshd[716]: in pam smauthenticate(): Failed to determine Kerberos principal name.
Feb 23 14:08:55 ph-jeffkline-l01 sshd[714]: Accepted keyboard-interactive/pam for kline from ::1 port 50564 ssh2
Feb 23 14:08:55 ph-jeffkline-l01 com.apple.SecurityServer[23]: Session 0x238c05 created
Feb 23 14:08:55 ph-jeffkline-l01 com.apple.SecurityServer[23]: Session 0x238c05 attributes 0x20
Feb 23 14:08:55 ph-jeffkline-l01 sshd[714]: User child is on pid 718

Reply

Answer 11

Linc Davis

Level 10

209,739 points

Feb 23, 2011 12:25 PM in response to Jeff in Madison

SSH connection requests to 127.0.0.1 (but not to localhost) are being blocked before they reach the server, or your client isn't sending them.

Do you have a file at /etc/hosts.deny, and if so, does it have an entry for 127.0.0.1?

Can you ping 127.0.0.1?

Reply

Answer 12

Feb 23, 2011 12:35 PM in response to Linc Davis

I can reach port 21, but not port 22. Here is an example

ph-jeffkline-l01:~ kline$ telnet 127.0.0.1 21
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused
telnet: Unable to connect to remote host
ph-jeffkline-l01:~ kline$ telnet 127.0.0.1 22
Trying 127.0.0.1...

Timeout...

Reply

Answer 13

Feb 23, 2011 12:42 PM in response to Linc Davis

oh, and no file /etc/hosts.deny
In finding this, I checked /etc/hosts saw the lines

127.0.0.1 localhost
255.255.255.255 broadcasthost
::1 localhost
fe80::1%lo0 localhost

Seeing this, I tried two things (and had success):
$ telnet fe80::1%lo0 22
Trying fe80::1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.2

$ telnet ::1 22
Trying ::1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.2

Reply

Answer 14

Linc Davis

Level 10

209,739 points

Feb 23, 2011 1:22 PM in response to Jeff in Madison

Well, it seems that an unseen hand is blocking TCP connections to 127.0.0.1:22, but not to localhost:22. It's not your SSH client, because telnet doesn't work either. It's not your SSH server, because it doesn't receive the packets. You haven't modified your hosts file. There is no tcpwrapper and no firewall.

I know of no configuration that would cause all this to happen. Maybe someone else does. If not, I'd be forced to conclude that you have a very weird corruption of the TCP/IP stack in your kernel. Have you tried rebooting since this started?

Reply

Answer 15

Linc Davis

Level 10

209,739 points

Feb 23, 2011 1:32 PM in response to Linc Davis

Turn of Remote Login, and in a Terminal window enter

sudo nc -l 22

Then open another tab or window and enter

nc 127.0.0.1 22

Now, in the second window, type some text (anything) and hit return. You should see the text you typed in the first window.

Reply