Ssh connection refused

[sakraf]

Hey guys!
Im trying to set up ssh at the moment with putty but whenever I click on "Open" it says "Connection refused". The port is both in the config file and in putty 22. I have no idea what to do please help me!

PS: Sorry for bad english.

[DougieLawson]

Connection refused means one of three things.
1. You've got the wrong IP address and the machine you've reached, obviously, doesn't have port 22 open.
2. You've got the right IP but sshd isn't listening on port 22
3. There's a software firewall on either the local or the target machine

[FTrevorGowen]

Connection refused means one of three things.
1. You've got the wrong IP address and the machine you've reached, obviously, doesn't have port 22 open.
2. You've got the right IP but sshd isn't listening on port 22
3. There's a software firewall on either the local or the target machine

I would add (what is, effectively, a "variation" of #2): it also happens when you try to connect to a NOOBS installed (Raspbian) system "too soon"** ie. before NOOBS has transferred to the default O.S. and that has started the server - this takes at least 10 seconds.
Trev.
** Something I'm quite regularly "guilty of" unfortunately.

[DougieLawson]

Trev, I wouldn't know about NOOBS. I've got one system running it but it's a "mostly ignored" RPi.

[sakraf]

Connection refused means one of three things.
1. You've got the wrong IP address and the machine you've reached, obviously, doesn't have port 22 open.
2. You've got the right IP but sshd isn't listening on port 22
3. There's a software firewall on either the local or the target machine

Thanks for the reply.
1 .I retrieved the ip-adress with hostname -i on the Raspberry Pi.
2. I didn't change anything and I think 22 is the default port. How do you check that port is still 22?
3. I didn't install any firewalls or antivirus programs on both my PC and my Pi.

Where could the problem be?

I would add (what is, effectively, a "variation" of #2): it also happens when you try to connect to a NOOBS installed (Raspbian) system "too soon"** ie. before NOOBS has transferred to the default O.S. and that has started the server - this takes at least 10 seconds.
Trev.

Thanks for the reply.
I installed Raspbian directly with an image because NOOBS didn't work on my 64 GB card.

[rpdom]

2. I didn't change anything and I think 22 is the default port. How do you check that port is still 22?

One way to check is to use the netstat command, like this

Code: Select all

rpdom@raspi4:~$ netstat -an | grep :22
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp6       0      0 :::22                   :::*                    LISTEN     
rpdom@raspi4:~$ 

That shows my ssh server listening on port 22 on ipv4 and ipv6.
Also, in /etc/ssh/sshd_config you should have

Code: Select all

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22

at the beginning of the file.

[DougieLawson]

You need to use hostname -I (capital eye) not hostname -i (lower case eye)

pi@aplus ~ $ hostname -i # little eye
127.0.1.1
pi@aplus ~ $ hostname -I # big EYE.
192.168.1.17
pi@aplus ~ $

[sakraf]

Also, in /etc/ssh/sshd_config you should have

Code: Select all

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22

at the beginning of the file.

It says 22 for me too.

You need to use hostname -I (capital eye) not hostname -i (lower case eye

Well, with that new IP my Putty says "Network is unreachable" SSH is enabled on my Pi. What am I doing wrong?

[rpdom]

What is the IP address of the Pi and the computer that you're running Putty on?

They should start with the same set of numbers, probably 192.168.x.y or 10.x.y.z

[wolfpi024]

I had a similar problem at the beginning, with Pi and Desktop PC both being in the same network, but I was unable to connect to my Pi. I solved this by setting up a static ping script on the Pi which continuously performs a ping to the Desktop

Code: Select all

ping 192.168.xxx.yyy -t

Since then it is working flawlessly

As for a script doing this, I just made a simple one, saved it as pingme.sh and added it to my startup script that runs on every boot.

Code: Select all

#!/bin/bash
ping 192.168.xxx.yyy -t &

[DougieLawson]

Get the output from the following commands

ifconfig -a
ip route
ping -c3 8.8.8.8
cat /etc/resolv.conf
ping -c3 google.com

Don't bother blanking out addresses, we can't get to the LAN side of your network so exposing your local addresses doesn't matter.

[wolfpi024]

I am very well aware of the fact that you SHOULD not be able to, although from my personal experience with a friend that is studying ITS I can not confirm that you can't or rather that it could not be useful to someone who gets access to any device inside the network =)

Apart from that it wasn't really the fear of being hacked but rather the neutrality of variables why I chose them.

[sakraf]

Sorry for not answering the last days, I had no time. Here is the output of the commands: @DougieLawson

Code: Select all

pi@raspberrypi ~ $ ifconfig -a
eth0      Link encap:Ethernet  HWaddr b8:27:eb:0d:45:3f  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:104 errors:0 dropped:0 overruns:0 frame:0
          TX packets:104 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:8880 (8.6 KiB)  TX bytes:8880 (8.6 KiB)

wlan0     Link encap:Ethernet  HWaddr 74:da:38:3a:24:75  
          inet addr:10.0.0.1  Bcast:10.0.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:45 errors:0 dropped:113 overruns:0 frame:0
          TX packets:78 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:6863 (6.7 KiB)  TX bytes:11842 (11.5 KiB)

pi@raspberrypi ~ $ ip route
default via 10.0.0.138 dev wlan0  metric 303 
10.0.0.0/24 dev wlan0  proto kernel  scope link  src 10.0.0.1  metric 303 
pi@raspberrypi ~ $ ping -c3 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_req=1 ttl=58 time=25.3 ms
64 bytes from 8.8.8.8: icmp_req=2 ttl=58 time=25.1 ms
64 bytes from 8.8.8.8: icmp_req=3 ttl=58 time=25.4 ms

--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 25.132/25.307/25.459/0.134 ms
pi@raspberrypi ~ $ cat /etc/resolv.conf
# Generated by resolvconf
domain home
nameserver 10.0.0.138
pi@raspberrypi ~ $ ping -c3 google.com
PING google.com (188.21.9.23) 56(84) bytes of data.
64 bytes from 188.21.9.23: icmp_req=1 ttl=60 time=15.9 ms
64 bytes from 188.21.9.23: icmp_req=2 ttl=60 time=16.9 ms
64 bytes from 188.21.9.23: icmp_req=3 ttl=60 time=16.0 ms

--- google.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 10089ms
rtt min/avg/max/mdev = 15.997/16.345/16.977/0.447 ms
pi@raspberrypi ~ $ 

[DougieLawson]

Your RPi has a perfectly normal network.

So your problem is either with your ssh client or the sshd daemon.

What does netstat -tln show?
What happens if you try ssh 127.0.0.1 (on your RPi)?

[sakraf]

What does netstat -tln show?
What happens if you try ssh 127.0.0.1 (on your RPi)?

Code: Select all

pi@raspberrypi ~ $ netstat -tln show
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
pi@raspberrypi ~ $ ssh 127.0.0.1
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
ECDSA key fingerprint is 56:85:c1:4d:fd:a8:29:9a:09:3c:2e:c9:a7:28:c8:d8.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
pi@127.0.0.1's password: 
Linux raspberrypi 3.18.11-v7+ #781 SMP PREEMPT Tue Apr 21 18:07:59 BST 2015 armv7l

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon Jul  6 18:29:57 2015
pi@raspberrypi ~ $ 

[DougieLawson]

OK. So your RPi is running sshd and you can connect to it.

What do you get from
ifconfig -a
ip route
ping -c3 8.8.8.8
cat /etc/resolv.conf
ping -c3 google.com

[JimmyN]

Maybe I'm missing something, but things don't look quite right to me.

The ifconfig -a shows a wlan address of :

Code: Select all

wlan0     Link encap:Ethernet  HWaddr 74:da:38:3a:24:75 
          inet addr:10.0.0.1  Bcast:10.0.0.255  Mask:255.255.255.0

And cat /etc/resolv.conf shows the nameserver IP as;

Code: Select all

# Generated by resolvconf
domain home
nameserver 10.0.0.138

And we see that same thing with ip route;

Code: Select all

default via 10.0.0.138 dev wlan0  metric 303

It seems the current RPi's wlan IP is 10.0.0.1 and resolv.conf and ip route show it's going to look for a nameserver at 10.0.0.138. Yet the ping to Google.com seemed to work???

On the RPi I have running here at my desk I get;

Code: Select all

hostname -I
192.168.0.8

wlan0     Link encap:Ethernet  HWaddr 74:da:38:2b:49:a5 
          inet addr:192.168.0.8  Bcast:192.168.0.255  Mask:255.255.255.0

cat /etc/resolv.conf
nameserver 68.105.28.11   <--Cox cable nameservers
nameserver 68.105.29.11

ip route
default via 192.168.0.1 dev wlan0
192.168.0.0/24 dev wlan0 proto kernel scope link src 192.168.0.8 

So it seems to me that the DNS and IP addresses of the RPi are reversed, yet it was able to resolve the google.com ping request.

[DougieLawson]

So what happens on windows?

Can you ping 10.0.0.138?
Can you ping 10.0.0.1?

What does
ipconfig /all
show?

[sakraf]

Canyou ping 10.0.0.138?

Yes.

Can you ping 10.0.0.1?

No.

What does
ipconfig /all
show?

Im sorry, my Windows is german and it seems you cant change the cmd Language. Here is what it says in german:

Code: Select all

C:\Users\Tim>ipconfig /all

Windows-IP-Konfiguration

   Hostname  . . . . . . . . . . . . : TIM-PC-2
   Primäres DNS-Suffix . . . . . . . :
   Knotentyp . . . . . . . . . . . . : Hybrid
   IP-Routing aktiviert  . . . . . . : Nein
   WINS-Proxy aktiviert  . . . . . . : Nein
   DNS-Suffixsuchliste . . . . . . . : home

Drahtlos-LAN-Adapter LAN-Verbindung* 12:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix:
   Beschreibung. . . . . . . . . . . : Virtueller Microsoft-Adapter für direktes
 WiFi
   Physische Adresse . . . . . . . . : 68-5D-43-F0-F0-A1
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Ethernet-Adapter Bluetooth-Netzwerkverbindung:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix:
   Beschreibung. . . . . . . . . . . : Bluetooth-Gerät (PAN)
   Physische Adresse . . . . . . . . : 68-5D-43-F0-F0-A4
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Ethernet-Adapter Ethernet:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix:
   Beschreibung. . . . . . . . . . . : Controller der Familie Realtek PCIe GBE
   Physische Adresse . . . . . . . . : 00-26-2D-CB-FA-75
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Drahtlos-LAN-Adapter WiFi:

   Verbindungsspezifisches DNS-Suffix: home
   Beschreibung. . . . . . . . . . . : Intel(R) Centrino(R) Wireless-N 2230
   Physische Adresse . . . . . . . . : 68-5D-43-F0-F0-A0
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja
   Verbindungslokale IPv6-Adresse  . : fe80::5c4b:8fe7:5384:632e%3(Bevorzugt)
   IPv4-Adresse  . . . . . . . . . . : 10.0.0.16(Bevorzugt)
   Subnetzmaske  . . . . . . . . . . : 255.255.255.0
   Lease erhalten. . . . . . . . . . : Dienstag, 07. Juli 2015 18:53:04
   Lease läuft ab. . . . . . . . . . : Mittwoch, 08. Juli 2015 18:53:03
   Standardgateway . . . . . . . . . : 10.0.0.138
   DHCP-Server . . . . . . . . . . . : 10.0.0.138
   DHCPv6-IAID . . . . . . . . . . . : 258497859
   DHCPv6-Client-DUID. . . . . . . . : 00-01-00-01-1B-B8-4B-59-00-26-2D-CB-FA-75

   DNS-Server  . . . . . . . . . . . : 10.0.0.138
   NetBIOS über TCP/IP . . . . . . . : Aktiviert

Ethernet-Adapter Ethernet 2:

   Verbindungsspezifisches DNS-Suffix:
   Beschreibung. . . . . . . . . . . : LogMeIn Hamachi Virtual Ethernet Adapter
   Physische Adresse . . . . . . . . : 7A-79-19-5C-AB-2E
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja
   IPv6-Adresse. . . . . . . . . . . : 2620:9b::195c:ab2e(Bevorzugt)
   Verbindungslokale IPv6-Adresse  . : fe80::f951:150:3e5c:281f%13(Bevorzugt)
   IPv4-Adresse  . . . . . . . . . . : 25.92.171.46(Bevorzugt)
   Subnetzmaske  . . . . . . . . . . : 255.0.0.0
   Lease erhalten. . . . . . . . . . : Dienstag, 07. Juli 2015 18:53:22
   Lease läuft ab. . . . . . . . . . : Mittwoch, 06. Juli 2016 18:53:23
   Standardgateway . . . . . . . . . : 2620:9b::1900:1
                                       25.0.0.1
   DHCP-Server . . . . . . . . . . . : 25.0.0.1
   DHCPv6-IAID . . . . . . . . . . . : 235032818
   DHCPv6-Client-DUID. . . . . . . . : 00-01-00-01-1B-B8-4B-59-00-26-2D-CB-FA-75

   DNS-Server  . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS über TCP/IP . . . . . . . : Aktiviert

Tunneladapter isatap.home:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: home
   Beschreibung. . . . . . . . . . . : Microsoft-ISATAP-Adapter
   Physische Adresse . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja

Tunneladapter LAN-Verbindung* 3:

   Verbindungsspezifisches DNS-Suffix:
   Beschreibung. . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physische Adresse . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja
   IPv6-Adresse. . . . . . . . . . . : 2001:0:9d38:6abd:2cda:2d05:3d59:982e(Bevo
rzugt)
   Verbindungslokale IPv6-Adresse  . : fe80::2cda:2d05:3d59:982e%8(Bevorzugt)
   Standardgateway . . . . . . . . . :
   DHCPv6-IAID . . . . . . . . . . . : 134217728
   DHCPv6-Client-DUID. . . . . . . . : 00-01-00-01-1B-B8-4B-59-00-26-2D-CB-FA-75

   NetBIOS über TCP/IP . . . . . . . : Deaktiviert

Tunneladapter isatap.{B2B144C2-C612-46D6-B422-3D67D9A875EA}:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix:
   Beschreibung. . . . . . . . . . . : Microsoft-ISATAP-Adapter #4
   Physische Adresse . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja

If you don't understand it, please say and I'll translate what you need.

[DougieLawson]

Don't worry I'm fluent in technical German.

So your RPi and your laptop are both in the same 10.0.0.0/24 (netmask 255.255.255.0) subnet. That means it's something outside the RPi that's preventing your laptop from connecting.

That's either going to be the Windows firewall (do you have 10.0.0.0/24 defined as a trusted private network?) or it's something odd happening with your router/switch (which I'll guess is a Technicolor TG582n).

Start by looking at Windows and whether it considers your network as public or private.