I am wondering if there is a way to get around my schools outgoing SSH blocks to control my raspberry Pi minecraft server. I have port forwarded external port 2222 to 22 and it works from inside my network but not at school. I am using an iPad app to SSH and I have noticed that it can pickup the OS but not login.

The error I am getting is handshake failed.

Is there a way I can get around this issue?

1 Answer 1


Before jumping to any conclusions, try connecting from another network like your friend's WiFi connection.

Based on the message, they're not blocking your connection since you can actually connect to your Pi. The problem here is that your SSH server isn't configured properly.

Now, the misconfiguration may be too broad for me to enumerate all of them. It might be a typo, something might have been uncommented accidentally, syntax error, etc. The most common cause would be you tried to mess around with file-based authentication and failed and/or your app doesn't support it.

Another cause would be your app is simply... how should I say it... fecal matter. In that case, download another one. I recommend Prompt.

If they are, in fact, blocking your connection, then you could use some of the "famous" ports provided you're not using them. Try to forward port 80 or 443 to 22 on your home router and connect to SSH using port 80 or 443 from school.

If the app is not the one to blame or it still happens after using the more famous ports, your Pi might be misconfigured. In that case,

Here's a known working configuration from my own pi. The file is /etc/ssh/sshd_config. Make a backup of yours and replace it comletely with this one.

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin without-password
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
IgnoreUserKnownHosts no
PasswordAuthentication yes
GatewayPorts no
AllowTcpForwarding yes
KeepAlive yes

I'm not saying these are the absolute causes. I'm saying that these are the most probable causes

  • Did you write this answer? I assume you did because you have more rep than the guy who posted it there. Please report it if you did. Btw Thanks for the answer. I have already tried from a website ssh service and it worked perfectly. I have not stuffed around in ssh's config file and the app I am using is a very good one called Server Auditor. I shall try forwarding 80 (I assume it won't stuff up email on my other machines?). Apr 27, 2016 at 8:30
  • @JonahFleming Yeah, I actually did write this answer. I'm the same guy. Check the username of the poster, which is me, PandaLion98. A profile can be used on multiple Stacks and have different reps on these stacks. I have about 100+ rep on Superuser.SE while I have 3k rep here. In short, a single username can be used on multiple stacks. No two users can have the same username anywhere on Stackexchange, therefore, I'm the same guy.
    – Aloha
    Apr 27, 2016 at 16:47
  • Ok cool. Glad it isn't copied. Apr 27, 2016 at 21:01
  • None of the solutions worked. I have port forwarded port 80 to port 22 but I still get the handshake failed error. Any suggestions? Apr 27, 2016 at 22:00
  • Try SSH-ing from a PC/laptop from school. If you don't have one but a friend does, copy Putty to your flash drive. putty.org
    – Aloha
    Apr 28, 2016 at 0:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.