<font size=2 face="sans-serif">I am a little lost here, I have seen conflicting
claims about where the handshake ends. Are *both* sides receiving
the </font><font size=2>SSH2_MSG_KEXINIT </font><font size=2 face="sans-serif">?
Can you take packet traces anywhere in between your two endpoints?</font><br><br><font size=2 face="sans-serif">I have seen networks include security
middleboxes that are a little incompetent --- when the </font><font size=2>SSH2_MSG_KEXINIT
</font><font size=2 face="sans-serif"> message's size is above some
threshold (somewhere between 1 and 1.5 KB) the middlebox aborts the connection,
sending TCP RST to both client and server.</font><br><br><font size=2 face="sans-serif">Regards,<br>Mike</font><br><br><br><br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">Salvatore Orlando <salv.orlando@gmail.com></font><br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">aishwarya.adyanthaya@accenture.com</font><br><font size=1 color=#5f5f5f face="sans-serif">Cc:
</font><font size=1 face="sans-serif">openstack-operators@lists.openstack.org</font><br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">08/03/2015 07:38 PM</font><br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">Re: [Openstack-operators]
ssh inside instance</font><br><hr noshade><br><br><br><font size=3>More details about your environment might be useful.</font><br><font size=3>For instance, are you running neutron with the "reference
implementation" - or some other plugin/driver?</font><br><font size=3>Is the logical router where the floating IP is attached
a distributed router?<br></font><br><font size=3>Also, if you run tcpdump on the receiving instance, you
should probably be able to see the SSH packet coming in. What source address
does it have?</font><br><font size=3>Finally - I'm not sure if you already stated this - are
you able to ping the instance using its floating IP from another instance?<br></font><br><font size=3>Salvatore</font><br><br><br><font size=3>On 3 August 2015 at 11:08, <</font><a href=mailto:aishwarya.adyanthaya@accenture.com target=_blank><font size=3 color=blue><u>aishwarya.adyanthaya@accenture.com</u></font></a><font size=3>>
wrote:</font><br><font size=2>Yes, I did notice that it isn’t receiving from the line:</font><p><font size=2>debug1: SSH2_MSG_KEXINIT received</font><p><font size=2> </font><p><font size=2>I have an internal IP and an external IP (floating IP)
attached to the instance. If I make use of the internal IP to ssh itself
from the very same node I’m able to do it but External IP isn’t working.
</font><p><font size=2> </font><p><font size=2>I am able to ssh to the same machine with the floating
IP outside Openstack but internally it doesn’t seem to work. My goal here
is to ssh within an instance using the floating IP.</font><p><font size=2> </font><p><font size=2>Thank you, </font><p><font size=2>Aishwarya</font><p><font size=2 face="Calibri"> </font><p><font size=2 color=#004080 face="Calibri"> </font><p><font size=2 face="Tahoma"><b>From:</b> Salvatore Orlando [mailto:</font><a href=mailto:salv.orlando@gmail.com target=_blank><font size=2 color=blue face="Tahoma"><u>salv.orlando@gmail.com</u></font></a><font size=2 face="Tahoma">]
<b><br>Sent:</b> Friday, July 31, 2015 5:56 PM<b><br>To:</b> Adyanthaya, Aishwarya<b><br>Cc:</b> </font><a href=mailto:Neil.Jerram@metaswitch.com target=_blank><font size=2 color=blue face="Tahoma"><u>Neil.Jerram@metaswitch.com</u></font></a><font size=2 face="Tahoma">;
</font><a href="mailto:openstack-operators@lists.openstack.org" target=_blank><font size=2 color=blue face="Tahoma"><u>openstack-operators@lists.openstack.org</u></font></a><p><font size=3><b><br>Subject:</b> Re: [Openstack-operators] ssh inside instance</font><p><font size=3> </font><p><font size=3>Why are you focusing on authentication issues when it seems
you have either a sshd config issue or a connectivity problem?</font><p><font size=3> </font><p><font size=3>Indeed your ssh handshake is stopping quite early - see
below:</font><p><font size=3> </font><p><font size=3>debug1: Connecting to 192.168.1.250 [192.168.1.250] port
22.</font><p><font size=3>debug1: Connection established.</font><p><font size=3>debug1: Enabling compatibility mode for protocol 2.0</font><p><font size=3>debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2</font><p><font size=3>debug1: Remote protocol version 2.0, remote software version
OpenSSH_5.6</font><p><font size=3>debug1: match: OpenSSH_5.6 pat OpenSSH_5* compat 0x0c000000</font><p><font size=3>debug1: SSH2_MSG_KEXINIT sent</font><p><font size=3>debug1: SSH2_MSG_KEXINIT received</font><p><font size=3>debug1: kex: server->client aes128-ctr hmac-sha1 none</font><p><font size=3>debug1: kex: client->server aes128-ctr hmac-sha1 none</font><p><font size=3>debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<7680<8192)
sent</font><p><font size=3>debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP</font><p><font size=3>debug1: SSH2_MSG_KEX_DH_GEX_INIT sent</font><p><font size=3>debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY</font><p><font size=3>debug1: Server host key: <MEH></font><p><font size=3>debug1: Host '192.168.1.250' is known and matches the RSA
host key.</font><p><font size=3>debug1: Found key in /home/salvatore/.ssh/known_hosts:21</font><p><font size=3>debug1: ssh_rsa_verify: signature correct</font><p><font size=3>debug1: SSH2_MSG_NEWKEYS sent</font><p><font size=3>debug1: expecting SSH2_MSG_NEWKEYS</font><p><font size=3>debug1: SSH2_MSG_NEWKEYS received</font><p><font size=3>debug1: Roaming not allowed by server</font><p><font size=3>debug1: SSH2_MSG_SERVICE_REQUEST sent</font><p><font size=3>debug1: SSH2_MSG_SERVICE_ACCEPT received</font><p><font size=3>debug1: Authentications that can continue: publickey,keyboard-interactive</font><p><font size=3>debug1: Next authentication method: publickey</font><p><font size=3>debug1: Offering RSA public key: /home/salvatore/.ssh/id_rsa</font><p><font size=3>debug1: Authentications that can continue: publickey,keyboard-interactive</font><p><font size=3> </font><p><font size=3>Your instance seem to not be receiving back SSH2_MSG_KEXINIT.</font><p><font size=3>Note: this question is more suitable for </font><a href=http://ask.openstack.org/ target=_blank><font size=3 color=blue><u>ask.openstack.org</u></font></a><font size=3>than for this ML imho.</font><p><font size=3> </font><p><font size=3>Salvatore</font><p><font size=3> </font><p><font size=3> </font><p><font size=3> </font><p><font size=3>On 30 July 2015 at 10:14, <</font><a href=mailto:aishwarya.adyanthaya@accenture.com target=_blank><font size=3 color=blue><u>aishwarya.adyanthaya@accenture.com</u></font></a><font size=3>>
wrote:</font><p><font size=3>Hi Neil,</font><p><font size=3> </font><p><font size=3>I did the same as you have suggested. I have created an
instance A and generated a private_key, giving it 600 permission. Using
the key I launched the instance B but when I ssh from the instance A after
a while it reads:</font><p><font size=3> </font><p><font size=3>Read from socket failed: Connection timed out</font><p><font size=3> </font><p><font size=3>I even tried with ssh –v hostname to test on one the machine
outside openstack and the instance.</font><p><font size=3 color=#004080> </font><p><font size=3 color=#004080>root@new:/home/ubuntu# ssh -v new</font><p><font size=3 color=#004080>OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014</font><p><font size=3 color=#004080>debug1: Reading configuration data /etc/ssh/ssh_config</font><p><font size=3 color=#004080>debug1: /etc/ssh/ssh_config line 19: Applying
options for *</font><p><font size=3 color=#004080>debug1: Connecting to new [10.x.x.x] port
22.</font><p><font size=3 color=#004080>debug1: Connection established.</font><p><font size=3 color=#004080>debug1: permanently_set_uid: 0/0</font><p><font size=3 color=#004080>debug1: identity file /root/.ssh/id_rsa type
-1</font><p><font size=3 color=#004080>debug1: identity file /root/.ssh/id_rsa-cert
type -1</font><p><font size=3 color=#004080>debug1: identity file /root/.ssh/id_dsa type
-1</font><p><font size=3 color=#004080>debug1: identity file /root/.ssh/id_dsa-cert
type -1</font><p><font size=3 color=#004080>debug1: identity file /root/.ssh/id_ecdsa
type -1</font><p><font size=3 color=#004080>debug1: identity file /root/.ssh/id_ecdsa-cert
type -1</font><p><font size=3 color=#004080>debug1: identity file /root/.ssh/id_ed25519
type -1</font><p><font size=3 color=#004080>debug1: identity file /root/.ssh/id_ed25519-cert
type -1</font><p><font size=3 color=#004080>debug1: Enabling compatibility mode for protocol
2.0</font><p><font size=3 color=#004080>debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1
Ubuntu-2ubuntu2</font><p><font size=3 color=#004080>debug1: Remote protocol version 2.0, remote
software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2</font><p><font size=3 color=#004080>debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
pat OpenSSH_6.6.1* compat 0x04000000</font><p><font size=3 color=#004080>debug1: SSH2_MSG_KEXINIT sent</font><p><font size=3 color=#004080> </font><p><font size=3>Read from socket failed: Connection timed out</font><p><font size=3> </font><p><font size=3>So this is what I’m getting again.</font><p><font size=3> </font><p><font size=3>Thank you,</font><p><font size=3>Aishwarya</font><p><font size=3 color=#004080> </font><p><font size=2 face="Tahoma"><b>From:</b> Neil Jerram [mailto:</font><a href=mailto:Neil.Jerram@metaswitch.com target=_blank><font size=2 color=blue face="Tahoma"><u>Neil.Jerram@metaswitch.com</u></font></a><font size=2 face="Tahoma">]
<b><br>Sent:</b> Thursday, July 30, 2015 1:38 PM<b><br>To:</b> Adyanthaya, Aishwarya; </font><a href="mailto:openstack-operators@lists.openstack.org" target=_blank><font size=2 color=blue face="Tahoma"><u>openstack-operators@lists.openstack.org</u></font></a><font size=2 face="Tahoma"><b><br>Subject:</b> Re: [Openstack-operators] ssh inside instance</font><p><font size=3> </font><p><font size=3 color=#004080>Hi Aishwarya, </font><p><font size=3 color=#004080> </font><p><font size=3 color=#004080>The basic requirement here is that anyone
- which really means a combination of a computer or instance, plus a user
on that computer/instance - needs to have the private key that matches
the public key that is installed on the target instance. </font><p><font size=3 color=#004080> </font><p><font size=3 color=#004080>You've asked about logging in from your first
instance ý- let's call it A - so you need to save the private key in a
file on A - let's call it private_key - and give it 600 permissions:</font><p><font size=3 color=#004080> </font><p><font size=3 color=#004080> chmod 600 private_key</font><p><font size=3 color=#004080> </font><p><font size=3 color=#004080>Then you can use this key with SSH like this:</font><p><font size=3 color=#004080> </font><p><font size=3 color=#004080> ssh -i private_key USER@OTHER-INSTANCE</font><p><font size=3 color=#004080> </font><p><font size=3 color=#004080>Hope that helps. </font><p><font size=3 color=#004080> </font><p><font size=3 color=#004080>Regards, </font><p><font size=3 color=#004080> Neil </font><p><font size=3 color=#004080> </font><p><table width=100% style="border-collapse:collapse;"><tr height=8><td width=100% bgcolor=white style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;"><font size=2 face="Tahoma"><b>From:
</b></font><a href=mailto:aishwarya.adyanthaya@accenture.com target=_blank><font size=2 color=blue face="Tahoma"><u>aishwarya.adyanthaya@accenture.com</u></font></a><p><font size=2 face="Tahoma"><b>Sent: </b>Thursday, 30 July 2015 05:24</font><p><font size=2 face="Tahoma"><b>To: </b></font><a href="mailto:openstack-operators@lists.openstack.org" target=_blank><font size=2 color=blue face="Tahoma"><u>openstack-operators@lists.openstack.org</u></font></a><p><font size=2 face="Tahoma"><b>Subject: </b>[Openstack-operators] ssh
inside instance</font></table><p><font size=3> </font><p><font size=3>Hi,</font><p><font size=3> </font><p><font size=3>I’ve launched two instances from my openstack dashboard.
Firstly I created instance one, where I generated a key through the ssh-keygen
command, pasting the public key contents to import key in the access and
security. Using this key I launched second instance.</font><p><font size=3> </font><p><font size=3>I want to be able to ssh the second instance from my first
instance. Could someone tell me how to work it out?</font><p><font size=3> </font><p><font size=3>Thank you,</font><p><font size=3>Aishwarya Adyanthaya</font><p><font size=3> </font><div align=center><hr></div><p><font size=1 color=#808080 face="Arial"><br>This message is for the designated recipient only and may contain privileged,
proprietary, or otherwise confidential information. If you have received
it in error, please notify the sender immediately and delete the original.
Any other use of the e-mail by you is prohibited. Where allowed by local
law, electronic communications with Accenture and its affiliates, including
e-mail and instant messaging (including content), may be scanned by our
systems for the purposes of information security and assessment of internal
compliance with Accenture policy. <br>______________________________________________________________________________________<br></font><font size=1 color=blue face="Arial"><u><br></u></font><a href=http://www.accenture.com/ target=_blank><font size=1 color=blue face="Arial"><u>www.accenture.com</u></font></a><font size=1 color=#808080 face="Arial"><br></font><p><font size=3> </font><p><font size=3><br>_______________________________________________<br>OpenStack-operators mailing list</font><font size=3 color=blue><u><br></u></font><a href="mailto:OpenStack-operators@lists.openstack.org" target=_blank><font size=3 color=blue><u>OpenStack-operators@lists.openstack.org</u></font></a><font size=3 color=blue><u><br></u></font><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" target=_blank><font size=3 color=blue><u>http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</u></font></a><p><font size=3> </font><p><tt><font size=2>_______________________________________________<br>OpenStack-operators mailing list<br>OpenStack-operators@lists.openstack.org<br></font></tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators"><tt><font size=2>http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</font></tt></a><tt><font size=2><br></font></tt><p><p><BR>