CODEWITHSUNDEEP
sshdockercontainersibm-cloudpublic-key
Quentin Manfroi
Quentin Manfroi

Reputation: 387

SSH connection to my container closed by remote host

I try to connect to my bluemix running container but I get this error :

ssh -p 22 login@134.*.*.*
Connection to 134.*.*.* closed by remote host.
Connection to 134.*.*.* closed.

I hidden ip for security.

During docker container building, I add my ssh public key to /home/login/.ssh/authorized_keys. Then I start my container (with sshd running) and open 22 port.

In local (with docker on my server), I can connect to ssh with my private key to the container. But when I start container on Bluemix, I can't connect to ssh even after attribute public ip address and, of course, publish 22 tcp port.

To run my container that I push to ibm repo, I use ICE cli to run container with a entry point script which start all services (within sshd).

ice run --publish 8572 --publish 8787 --publish 22 --memory 2048 --name boardvisor registry.ng.bluemix.net/org/test:latest  /run.sh

Then I go to bluexmix web dashboard to attribute public ip address

As I receive a response to sshd server, the container seems work and reachable but I don't understand why I can connect on my docker server but not on bluemix server.

I provide you the ssh verbose connection :

OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 134.168.6.95 [134.168.6.95] port 22.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load "/home/idcware/.ssh/id_rsa" as a RSA1 public key
debug1: identity file /home/idcware/.ssh/id_rsa type 1
debug1: identity file /home/idcware/.ssh/id_rsa-cert type -1
debug3: Incorrect RSA1 identifier
debug3: Could not load "/home/idcware/.ssh/id_dsa" as a RSA1 public key
debug1: identity file /home/idcware/.ssh/id_dsa type -1
debug1: identity file /home/idcware/.ssh/id_dsa-cert type -1
debug1: identity file /home/idcware/.ssh/id_ecdsa type -1
debug1: identity file /home/idcware/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/idcware/.ssh/id_ed25519 type -1
debug1: identity file /home/idcware/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "134.168.6.95" from file "/home/idcware/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/idcware/.ssh/known_hosts:3
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],[email protected],[email protected],[email protected],ssh-ed25519,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: setup [email protected]
debug1: kex: server->client aes128-ctr [email protected] none
debug2: mac_setup: setup [email protected]
debug1: kex: client->server aes128-ctr [email protected] none
debug1: kex: [email protected] need=16 dh_need=16
debug1: kex: [email protected] need=16 dh_need=16
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA f8:88:10:d1:91:bd:42:ec:d1:04:e5:00:c6:ab:11:e9
debug3: load_hostkeys: loading entries for host "134.168.6.95" from file "/home/idcware/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/idcware/.ssh/known_hosts:3
debug3: load_hostkeys: loaded 1 keys
debug1: Host '134.168.6.95' is known and matches the ECDSA host key.
debug1: Found key in /home/idcware/.ssh/known_hosts:3
debug1: ssh_ecdsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/idcware/.ssh/id_rsa (0x7fb6e3792fd0),
debug2: key: /home/idcware/.ssh/id_dsa ((nil)),
debug2: key: /home/idcware/.ssh/id_ecdsa ((nil)),
debug2: key: /home/idcware/.ssh/id_ed25519 ((nil)),
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-keyex
debug3: remaining preferred: gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-keyex
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug2: we did not send a packet, disable method
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available
debug1: Unspecified GSS failure.  Minor code may provide more information
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available
debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/idcware/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Trying private key: /home/idcware/.ssh/id_dsa
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type RSA
debug3: sign_and_send_pubkey: RSA 33:a3:84:5c:55:b4:4e:2d:c9:83:19:51:37:c6:5e:27
debug2: we sent a publickey packet, wait for reply
debug1: Authentication succeeded (publickey).
Authenticated to 134.168.6.95 ([134.168.6.95]:22).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: channel 0: free: client-session, nchannels 1
debug3: channel 0: status: The following connections are open:
  #0 client-session (t3 r-1 i0/0 o0/0 fd 4/5 cc -1)
Connection to 134.168.6.95 closed by remote host.
Connection to 134.168.6.95 closed.
Transferred: sent 3756, received 2112 bytes, in 0.0 seconds
Bytes per second: sent 278448.9, received 156571.9
debug1: Exit status -1

For container log, I only have this in consignation from bluemix web dashboard:

Dec 4 14:16:31 instance-0007a14f syslog-ng[11]: Log statistics; processed='src.internal(s_sys#1)=12', stamp='src.internal(s_sys#1)=1449234391', processed='destination(d_mlal)=0', processed='center(received)=12', processed='destination(d_spol)=0', processed='destination(d_mesg)=24', processed='destination(d_mail)=0', processed='destination(d_auth)=61', processed='destination(d_cron)=0', processed='destination(d_bv_info)=0', processed='center(queued)=85', processed='source(s_bv_syslog)=0', processed='src.none()=0', stamp='src.none()=0', processed='destination(d_bv_crit)=0', processed='global(payload_reallocs)=20', processed='global(sdata_updates)=0', processed='destination(d_bv_all)=0', processed='destination(d_bv_err)=0', processed='destination(d_boot)=0', processed='destination(d_kern)=0', processed='global(msg_clones)=0', processed='source(s_sys)=12', processed='destination(d_bv_process)=0'

Upvotes: 2

Views: 3448

Answers (2)

Johannes Reichard
Johannes Reichard

Reputation: 947

One principle in using containers is that a container should not start more than one process, in your case ssh and whatever the container is running. Also there is another way to access your container with exec

Scince Docker 1.3 you can access an runing container with:

docker exec COMMAND

in practice for bluemix:

cf ic exec -it CONTAINER /bin/bash

this starts the binary bash with an absolute path (/bin/bash part) and attaches the tty interactively + keeps connection open (-it part).

More infos: https://www.ng.bluemix.net/docs/containers/container_cli_reference_cfic.html#container_cli_reference_cfic__exec

Upvotes: 4

Umberto Manganiello
Umberto Manganiello

Reputation: 3233

Since the container works and it is reachable but you can't access it only on Bluemix, I suggest you to open a support request directly from your Bluemix console using the support/help widget or sending an email to [email protected]: in this way you'll involve IBM Containers support team in checking and fix this issue. They will be able to perform in-depth investigation of your error.

Please provide org and space guids and some details on the image you used.

You can retrieve org and space guids using CF CLI (when you already logged in):

cf org <orgname> --guid
cf space <spacename> --guid

Upvotes: 0

Related Questions