Unable to connect to QNAP with SSH

[odinher]

I have usually without problem connected to my TS-412 using Putty. For some reason, yesterday I got "Network error: Connection refused" when trying to SSH to the NAS. I checked and triple checked that the IP and port is correct. Next I checked (using web interface) that the security measures where not blocking me, by making sure they where disabled; Security -> Network Access Protection. Also tried restoring the default under the Security -> Certificate & Private key. Checked that SSH is in fact enabled under Network services -> Telnet/SSH. But still not able to connect. Checked my router that it didn't for some weird reason block the IP or port, but everything i vanilla (no restrictions). Read on the forum someone that experienced this that could SSH using Putty through WinSCP, but that didn't work for me. I can however FTP to it, and map it as a network drive and access it using web interface (everything else, but SSH). Anyone experienced this and can give me a hint on what to do next to make SSH work?

[pwilson]

I have usually without problem connected to my TS-412 using Putty. For some reason, yesterday I got "Network error: Connection refused" when trying to SSH to the NAS. I checked and triple checked that the IP and port is correct. Next I checked (using web interface) that the security measures where not blocking me, by making sure they where disabled; Security -> Network Access Protection. Also tried restoring the default under the Security -> Certificate & Private key. Checked that SSH is in fact enabled under Network services -> Telnet/SSH. But still not able to connect. Checked my router that it didn't for some weird reason block the IP or port, but everything i vanilla (no restrictions). Read on the forum someone that experienced this that could SSH using Putty through WinSCP, but that didn't work for me. I can however FTP to it, and map it as a network drive and access it using web interface (everything else, but SSH). Anyone experienced this and can give me a hint on what to do next to make SSH work?

1. Do your Router logs, NAS System Logs, or PuTTY logs provide any hints as to the issue?
2. Can PuTTY connect to your NAS via "Telnet" instead? (Telnet operates on port 13131/TCP on your NAS, rather than the default 23/TCP).
3. Have you made a firewall exception in your Windows/Linux machine for PuTTY?

[odinher]

I can not connect using Telnet. I've tried with 2 different Windows machines, and one Linux. Disabled firewall totally to be sure, no luck. There are no indication in the router/NAS log that the SSH/port 22 are changed/disabled.

[pwilson]

I can not connect using Telnet. I've tried with 2 different Windows machines, and one Linux. Disabled firewall totally to be sure, no luck. There are no indication in the router/NAS log that the SSH/port 22 are changed/disabled.

Are you attempting to login as "admin"? (The default SSHd/Telnetd servers on the NAS do not permit any login except from "admin").
Could you perhaps cut&paste the output of your SSH attempt from your Linux box?

Is your NAS still configured to use the standard Port/22 for SSH?

[odinher]

This is embarrasing. I've tried all the technical stuff.... but I figured, what the hell... let me reboot... No problem with SSH... Sorry for making this post :-/

[pwilson]

This is embarrasing. I've tried all the technical stuff.... but I figured, what the **... let me reboot... No problem with SSH... Sorry for making this post :-/

Don't be. It happens to the best of us. By sharing your experience, including the resolution, (no matter how embarrassing), you are helping the QNAP NAS Community. Seriously, don't be sorry, sharing this experience will help others. Thank-you for taking the time to reply to my inquiries.

I'm glad you figured it out. This is excellent troubleshooting, and sharing this, is of benefit to everyone! It is easy to miss troubleshooting steps, so this is useful information to share. You did good.

[valix]

Hi there,

I have a similar problem, but for me a reboot didn't solve the problem. I've a TS-212 that runs QTS 4.1.
Like the thread opener, I cannot access the admin console via ssh or telnet, but I can access the web interface using same admin credentials. As ssh / telnet client I'm used to use putty.
Obviously the ssh / telnet daemon is running, because each time I get a login prompt, but after entering the login credentials, I get the error message that the login is incorrect.
I've changed the telnet port to TCP/23. I tried from two different Windows machines (ssh+telnet) and remotely via internet (ssh only - telnet access from exterior connection is denied). The last time I tested the ssh connection to that TS was when QTS 3.8 or 3.6 was the latest. Since that time, shortly after the purchase, I hardly changed the basic config, just adding folders, changing passwords, adding users and so on.

I already tried to solve this in a german qnap forum - without any success.
Thanks!

[pwilson]

Hi there,

I have a similar problem, but for me a reboot didn't solve the problem. I've a TS-212 that runs QTS 4.1.
Like the thread opener, I cannot access the admin console via ssh or telnet, but I can access the web interface using same admin credentials. As ssh / telnet client I'm used to use putty.
Obviously the ssh / telnet daemon is running, because each time I get a login prompt, but after entering the login credentials, I get the error message that the login is incorrect.
I've changed the telnet port to TCP/23. I tried from two different Windows machines (ssh+telnet) and remotely via internet (ssh only - telnet access from exterior connection is denied). The last time I tested the ssh connection to that TS was when QTS 3.8 or 3.6 was the latest. Since that time, shortly after the purchase, I hardly changed the basic config, just adding folders, changing passwords, adding users and so on.

I already tried to solve this in a german qnap forum - without any success.
Thanks!

At the risk of repeating myself: Do your Router logs, NAS System Logs, or PuTTY logs provide any hints as to the issue?

[valix]

There is no need to have a look at the router log, because I tried to connect locally, within the LAN. But I tried to connect via the Internet, too. The NAS log shows me that the SSH or telnet login fails.

[pwilson]

At the risk of repeating myself: Do your Router logs, NAS System Logs, or PuTTY logs provide any hints as to the issue?

There is no need to have a look at the router log, because I tried to connect locally, within the LAN. But I tried to connect via the Internet, too. The NAS log shows me that the SSH or telnet login fails.

Do your NAS System Logs, or PuTTY logs provide any hints as to the issue?

Perhaps you could copy the log entries to this message thread so that we can see them. Have you attempted to do a Basic System Reset (2 secs) as recommended by all of the QNAP User manuals?

[valix]

Here some lines I copied from the log (export to csv-file) e.g.:

Code: Select all

82209,"Warning","2014-08-31","15:11:05","admin","192.168.0.12","---","TELNET","---","Login Fail"
82178,"Information","2014-08-31","15:09:02","admin","192.168.0.12","---","HTTP","Administration","Login OK"
81547,"Warning","2014-08-29","19:33:43","admin","192.168.0.16","---","SSH","---","Login Fail"
81546,"Warning","2014-08-29","19:33:05","admin","192.168.0.16","---","SSH","---","Login Fail"

Putty.log shows that:

Code: Select all

Event Log: Password authentication failed

It seems like I just would use every time wrong login credentials, but the login works for http(s).

Ok, I haven't done the basic config reset yet. But that will take some time, because at the moment (here it is 10:15 pm) I have only remote access to the NAS. Then I will need to reconfigure all firewall rules , I restricted the access. Only some (150?) domestic public IPs ranges are allowed. Btw. it is inconvenient to add rules via GUI, QNAP should improve it by remove the drop-downs for the net mask. But if ssh would work, I could use iptables

[pwilson]

Here some lines I copied from the log (export to csv-file) e.g.:

Code: Select all

82209,"Warning","2014-08-31","15:11:05","admin","192.168.0.12","---","TELNET","---","Login Fail"
82178,"Information","2014-08-31","15:09:02","admin","192.168.0.12","---","HTTP","Administration","Login OK"
81547,"Warning","2014-08-29","19:33:43","admin","192.168.0.16","---","SSH","---","Login Fail"
81546,"Warning","2014-08-29","19:33:05","admin","192.168.0.16","---","SSH","---","Login Fail"

Putty.log shows that:

Code: Select all

Event Log: Password authentication failed

It seems like I just would use every time wrong login credentials, but the login works for http(s).

Ok, I haven't done the basic config reset yet. But that will take some time, because at the moment (here it is 10:15 pm) I have only remote access to the NAS. Then I will need to reconfigure all firewall rules , I restricted the access. Only some (150?) domestic public IPs ranges are allowed. Btw. it is inconvenient to add rules via GUI, QNAP should improve it by remove the drop-downs for the net mask. But if ssh would work, I could use iptables

Does SSHd answer at all?

Code: Select all

telnet 10.77.13.145 22
Trying 10.77.13.145...
Connected to 10.77.13.145.
Escape character is '^]'.
SSH-2.0-OpenSSH_6.1
^C^]^P^[^]

telnet> 
?Invalid command
telnet> close
Connection closed.

Still no PuTTY logs provided, and therefore no proof that SSHd is even answering. Try telneting to the SSH Port (default 22/TCP) on the NAS to see if SSH is answering.

[valix]

Ok. You are asking for another proof that the daemons are running.

If there wouldn't run SSHd or TELENTd, I would never get a login prompt like that (this is what I already described in text format in my first post):

Like the thread opener, I cannot access the admin console via ssh or telnet, but I can access the web interface using same admin credentials. As ssh / telnet client I'm used to use putty.
Obviously the ssh / telnet daemon is running, because each time I get a login prompt , but after entering the login credentials, I get the error message that the login is incorrect.

ssh1.PNG

This is putty looks like when no sshd is running, but that is not the problem I have:

ssh2.PNG

And this is the windows telnet client looks like, when I try to telnet port 22 of my NAS:

ssh3.png

Concerning the putty log, Putty is able to generate 4 different types of logging.

putty.PNG

The putty.log line I posted is form "SSH Logging". Do you want me to change the kind of logging to another?


Is there another way to solve my problem except the basic reset (2 seconds), if it would do so?

[pwilson]

Ok. You are asking for another proof that the daemons are running.

If there wouldn't run SSHd or TELENTd, I would never get a login prompt like that (this is what I already described in text format in my first post):

Like the thread opener, I cannot access the admin console via ssh or telnet, but I can access the web interface using same admin credentials. As ssh / telnet client I'm used to use putty.
Obviously the ssh / telnet daemon is running, because each time I get a login prompt , but after entering the login credentials, I get the error message that the login is incorrect.

ssh1.PNG

This is putty looks like when no sshd is running, but that is not the problem I have:

ssh2.PNG

And this is the windows telnet client looks like, when I try to telnet port 22 of my NAS:

ssh3.png

Concerning the putty log, Putty is able to generate 4 different types of logging.

putty.PNG

The putty.log line I posted is form "SSH Logging". Do you want me to change the kind of logging to another?


Is there another way to solve my problem except the basic reset (2 seconds), if it would do so?

Your last screenshot proves that SSH is answering, so this probably rules out the so-called Network Access Protection feature:



Check it anyway, just to ensure that you aren't locked out. SSH uses the same credentials as the WebUI, so if you can login to the WebUI as "admin", then you should also be able to login to SSH as "admin" as well using the same credentials. (SSH on the NAS does not allow any user except "admin" to use it, are you perhaps attempting to login under a different userid?).

[valix]

That was my first thought too. I mean that my IP was banned due to too many failed login attempts, but this is not the case. Except it fails too often.
There is no blocked connection. A blocked connection/ banned IP would be opposite to the fact, that I can access the webui at the same time.

To ensure that the problem is no typo, I already changed the admin password to "123456" for a short time, but even that didn't work.

I know that the login credentials for both, admin via http and ssh are / should be the same. But it seems or the NAS behaves like it is not.
As you can see in my screens and my quoted logfiles above, I try to login as "admin".