[Bug 396667] New: SSH inaccessible from outside hosts through ipv6 - openSUSE Bugs - openSUSE Mailing Lists

newer
[Bug 409366] New:...

[Bug 396667] New: SSH inaccessible from outside hosts through ipv6

older
[Bug 406469] New: okular crashes...

bugzilla_noreply＠novell.com

3 Jun 2008 3 Jun '08

11:34

https://bugzilla.novell.com/show_bug.cgi?id=396667 Summary: SSH inaccessible from outside hosts through ipv6 Product: openSUSE 11.0 Version: RC 1 Platform: x86 OS/Version: openSUSE 11.0 Status: NEW Severity: Major Priority: P5 - None Component: Network AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: dsk@bglinux.org QAContact: qa@suse.de Found By: Outsourced Testing I cannot initiate connection to SSH using ipv6 eventhough I have permitted port 22 in the firewall. And sshd is listening on the ipv6 socket because I can connect from the local machine. I think when a service is permitted in the firewall also the ipv6 address family should be taken into consideration. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

Show replies by date

bugzilla_noreply＠novell.com

3 Jun 3 Jun

17:09

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 User rvojcik@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=396667#c1 Robert Vojcik changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |rvojcik@novell.com Status|NEW |NEEDINFO Info Provider| |dsk@bglinux.org --- Comment #1 from Robert Vojcik 2008-06-03 11:09:12 MDT --- Hello, please send me output of commands(under root): 1. netstat -ln | grep 22 2. ip6tables -L Thanks -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠novell.com

5 Jun 5 Jun

11:20

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 User dsk@bglinux.org added comment https://bugzilla.novell.com/show_bug.cgi?id=396667#c2 Nikolay Borisov changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW Info Provider|dsk@bglinux.org | --- Comment #2 from Nikolay Borisov 2008-06-05 05:20:39 MDT --- The output of ip6tables -l: Chain INPUT (policy DROP) target prot opt source destination ACCEPT all anywhere anywhere ACCEPT all anywhere anywhere state ESTABLISHED ACCEPT icmp anywhere anywhere state RELATED input_ext all anywhere anywhere input_ext all anywhere anywhere LOG all anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-IN-ILL-TARGET ' DROP all anywhere anywhere Chain FORWARD (policy DROP) target prot opt source destination LOG all anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-FWD-ILL-ROUTING ' Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all anywhere anywhere ACCEPT ipv6-icmp anywhere anywhere ACCEPT all anywhere anywhere state NEW,RELATED,ESTABLISHED LOG all anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-OUT-ERROR ' Chain forward_ext (0 references) target prot opt source destination Chain input_ext (2 references) target prot opt source destination ACCEPT ipv6-icmp anywhere anywhere ipv6-icmp echo-request ACCEPT ipv6-icmp anywhere anywhere ipv6-icmp router-solicitation ACCEPT ipv6-icmp anywhere anywhere ipv6-icmp router-advertisement ACCEPT ipv6-icmp anywhere anywhere ipv6-icmp neighbour-solicitation ACCEPT ipv6-icmp anywhere anywhere ipv6-icmp neighbour-advertisement ACCEPT ipv6-icmp anywhere anywhere ipv6-icmp redirect LOG tcp anywhere anywhere limit: avg 3/min burst 5 tcp dpt:spr-itunes flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP ' ACCEPT tcp anywhere anywhere tcp dpt:spr-itunes LOG tcp anywhere anywhere limit: avg 3/min burst 5 tcp dpt:spr-itunes flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP ' ACCEPT tcp anywhere anywhere tcp dpt:spr-itunes LOG tcp anywhere anywhere limit: avg 3/min burst 5 tcp dpt:spr-itunes flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP ' ACCEPT tcp anywhere anywhere tcp dpt:spr-itunes LOG tcp anywhere anywhere limit: avg 3/min burst 5 tcp dpt:spr-itunes flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP ' ACCEPT tcp anywhere anywhere tcp dpt:spr-itunes LOG tcp anywhere anywhere limit: avg 3/min burst 5 tcp dpt:spr-itunes flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP ' ACCEPT tcp anywhere anywhere tcp dpt:spr-itunes ACCEPT udp anywhere anywhere udp dpt:spr-itunes ACCEPT udp anywhere anywhere udp dpt:spr-itunes ACCEPT udp anywhere anywhere udp dpt:spr-itunes LOG tcp anywhere anywhere limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT ' LOG ipv6-icmp anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT ' LOG udp anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT ' LOG all anywhere anywhere limit: avg 3/min burst 5 state INVALID LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT-INV ' DROP all anywhere anywhere Chain reject_func (0 references) target prot opt source destination REJECT tcp anywhere anywhere reject-with tcp-reset REJECT udp anywhere anywhere reject-with icmp6-port-unreachable REJECT all anywhere anywhere reject-with icmp6-addr-unreachable DROP all anywhere anywhere otuput of netstat: tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 :::22 :::* LISTEN -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠novell.com

6 Jun 6 Jun

08:31

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 Andreas Jaeger changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-screening@forge.provo.novell.com |lnussel@novell.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠novell.com

08:45

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=396667#c3 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO Info Provider| |dsk@bglinux.org --- Comment #3 from Ludwig Nussel 2008-06-06 02:45:25 MDT --- are you sure you used FW_SERVICES_EXT_TCP? Does SuSEfirewall2 print any warnings if you call it manually? Works fine for me: linux-4ql1:~ # grep ^FW_SERVICES_EXT_TCP /etc/sysconfig/SuSEfirewall2 FW_SERVICES_EXT_TCP="ssh" linux-4ql1:~ # SuSEfirewall2 status | grep dpt:22 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpt:22 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP ' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 1 80 LOG tcp * * ::/0 ::/0 limit: avg 3/min burst 5 tcp dpt:22 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP ' 1 80 ACCEPT tcp * * ::/0 ::/0 tcp dpt:22 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠novell.com

11:54

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 User dsk@bglinux.org added comment https://bugzilla.novell.com/show_bug.cgi?id=396667#c4 Nikolay Borisov changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW Info Provider|dsk@bglinux.org | --- Comment #4 from Nikolay Borisov 2008-06-06 05:54:38 MDT --- Output of susefirewall2 status: 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpt:22 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP ' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 0 0 LOG tcp * * ::/0 ::/0 limit: avg 3/min burst 5 tcp dpt:22 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP ' 0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:22 output of the grep command: FW_SERVICES_EXT_TCP="5801 5901 ldap ldaps microsoft-ds netbios-ssn" (ssh is not present) But see attached picture. Secure shell server is enabled. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠novell.com

11:56

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 User dsk@bglinux.org added comment https://bugzilla.novell.com/show_bug.cgi?id=396667#c5 --- Comment #5 from Nikolay Borisov 2008-06-06 05:56:40 MDT --- Created an attachment (id=220697) --> (https://bugzilla.novell.com/attachment.cgi?id=220697) snapshot of firewall's screen -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠novell.com

12:11

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=396667#c6 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |INVALID --- Comment #6 from Ludwig Nussel 2008-06-06 06:11:08 MDT --- Your output of SuSEfirewall2 status shows that the port is open for both ipv4 and ipv6 so this is not a SuSEfirewall2 bug (the ::/0.*dpt:22 is ivp6). Your problem must be somewhere else, maybe your ipv6 dns setup is broken or something like that. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠novell.com

17:35

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 User dsk@bglinux.org added comment https://bugzilla.novell.com/show_bug.cgi?id=396667#c7 --- Comment #7 from Nikolay Borisov 2008-06-06 11:35:02 MDT --- There's no way that it's related to dns because I'm connecting using ipv6 address, not a dns name. I wonder why it works with ipv4 and not ipv6. I guess I will have to delve into this issue. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠novell.com

11 Jul 11 Jul

17:38

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 User tschaefer@t-online.de added comment https://bugzilla.novell.com/show_bug.cgi?id=396667#c8 Thomas Schäfer changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tschaefer@t-online.de Status|RESOLVED |REOPENED Resolution|INVALID | --- Comment #8 from Thomas Schäfer 2008-07-11 11:38:37 MDT --- I have got the same problem. It must be ipv6-firewall-MTU-related. Because: Intern/LAN: no problem at all extern (network with mtu less than 1500): it hangs after login, but the shell gets alive again, after stopping Suse-firefall. Without Suse-firewall, all connections (intern/extern-ipv4/ipv6) are working. Somebody suppresses to much icmp-packets. My config (after Suse-11.0-Installation and update today) FW_DEV_EXT="any eth0" FW_DEV_INT="" FW_DEV_DMZ="" FW_ROUTE="no" FW_MASQUERADE="no" FW_MASQ_DEV="zone:ext" FW_MASQ_NETS="0/0" FW_NOMASQ_NETS="" FW_PROTECT_FROM_INT="no" FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_EXT_RPC="" FW_CONFIGURATIONS_EXT="sshd" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_DMZ_RPC="" FW_CONFIGURATIONS_DMZ="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_INT_RPC="" FW_CONFIGURATIONS_INT="" FW_SERVICES_DROP_EXT="" FW_SERVICES_DROP_DMZ="" FW_SERVICES_DROP_INT="" FW_SERVICES_REJECT_EXT="" FW_SERVICES_REJECT_DMZ="" FW_SERVICES_REJECT_INT="" FW_SERVICES_ACCEPT_EXT="" FW_SERVICES_ACCEPT_DMZ="" FW_SERVICES_ACCEPT_INT="" FW_SERVICES_ACCEPT_RELATED_EXT="" FW_SERVICES_ACCEPT_RELATED_DMZ="" FW_SERVICES_ACCEPT_RELATED_INT="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="" FW_ALLOW_INCOMING_HIGHPORTS_UDP="" FW_FORWARD="" FW_FORWARD_REJECT="" FW_FORWARD_DROP="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG_LIMIT="" FW_LOG="" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_SOURCEQUENCH="" FW_ALLOW_FW_BROADCAST_EXT="no" FW_ALLOW_FW_BROADCAST_INT="no" FW_ALLOW_FW_BROADCAST_DMZ="no" FW_IGNORE_FW_BROADCAST_EXT="yes" FW_IGNORE_FW_BROADCAST_INT="no" FW_IGNORE_FW_BROADCAST_DMZ="no" FW_ALLOW_CLASS_ROUTING="" FW_CUSTOMRULES="" FW_REJECT="" FW_REJECT_INT="yes" FW_HTB_TUNE_DEV="" FW_IPv6="" FW_IPv6_REJECT_OUTGOING="" FW_IPSEC_TRUST="no" FW_ZONES="" FW_USE_IPTABLES_BATCH="" FW_LOAD_MODULES="nf_conntrack_netbios_ns" FW_FORWARD_ALWAYS_INOUT_DEV="" FW_FORWARD_ALLOW_BRIDGING="" -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠novell.com

14 Jul 14 Jul

09:27

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=396667#c9 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |NEEDINFO Info Provider| |tschaefer@t-online.de --- Comment #9 from Ludwig Nussel 2008-07-14 03:27:42 MDT --- The ipv6 code path accidently added rules for 'icmp' instead of 'icmpv6'. Maybe that's the cause. Would you mind trying SuSEfirewall2 from svn trunk or from the following location to verify the fix? http://beta.suse.com/private/lnussel/SuSEfirewall2-fcZn15958/ -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠novell.com

17:33

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 User tschaefer@t-online.de added comment https://bugzilla.novell.com/show_bug.cgi?id=396667#c10 Thomas Schäfer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |RESOLVED Info Provider|tschaefer@t-online.de | Resolution| |FIXED --- Comment #10 from Thomas Schäfer 2008-07-14 11:33:03 MDT --- To verify I did following: ssh root@tomyserver ssh -4 root@tomyserver Then I started the firewall-script. Restoration of old behaviour: ipv6-connection stalled after long outputs ipv4-connection no problem I stopped the firewall. Both ok. Than i installed the new package: wget http://beta.suse.com/private/lnussel/SuSEfirewall2-fcZn15958/SuSEfirewall2-3... and rpm -Uv SuSEfirewall2-3.6_SVNr195-12.noarch.rpm Preparing packages for installation... SuSEfirewall2-3.6_SVNr195-12 Updating etc/sysconfig/SuSEfirewall2... Now I started the firewall again. Both shells are still working. In my point of view the problem is solved. Regards, Thomas Schäfer -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠novell.com

15 Jul 15 Jul

06:57

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=396667#c11 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED | --- Comment #11 from Ludwig Nussel 2008-07-15 00:57:57 MDT --- Good :-) We need an online update so others can benetfit from the fix as well though. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠novell.com

06:58

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=396667#c12 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |NEEDINFO Info Provider| |ast@novell.com --- Comment #12 from Ludwig Nussel 2008-07-15 00:58:16 MDT --- Anja, I'd like to fix this for 11.0 via online update. Preferably together with bug 407825. Ok? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠novell.com

10:04

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=396667#c14 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |FIXED --- Comment #14 from Ludwig Nussel 2008-07-15 04:04:04 MDT --- update submitted -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠novell.com

21 Jul 21 Jul

13:12

New subject: [Bug 396667] SSH inaccessible from outside hosts through ipv6

https://bugzilla.novell.com/show_bug.cgi?id=396667 User ast@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=396667#c15 --- Comment #15 from Anja Stock 2008-07-21 07:12:14 MDT --- released -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Reply

Sign in to reply online Use email software

5764

Age (days ago)

5812

Last active (days ago)

Download

15 comments

1 participants

tags

participants (1)

bugzilla_noreply＠novell.com