I have a raspberry Pi 3 model B that I am hoping to turn into an SSH git server. I am able to SSH into the server just fine when I am on my home network, but I am unable to do so when I am on an outside network. When I try to login from an outside network, it asks me for a password despite having password authentication turned off. From ConnectBot on Android, the message I get is:

Connecing to (public ip):22 via ssh
Verified host 'RSA' key: (rsakey)
Key exchange algorithm: diffie-hellman-group-exchange-sha256
Using algorithm: aes256-ctr hmac-sha1
Trying to authenticate
Attempting 'publickey' authentication with a specific public key
Authentication method 'publickey' with key 'Piserver-keyy' failed
Attempting 'password' authentication
Authentication method 'password' failed

This comes up when I try logging in using the ports I have port-forwarding setup for (any other ports just hang and eventually disconnect).

I have tried the following to no avail:

  • I setup my router to support port forwarding (Netgear R6400). I set it up with multiple ports (including 22), and none of them seem to work.
  • I have contacted my ISP, and they claim that they do not block any ports. When I try scanning for open ports, I can only find ports 22 and 80. I'm assuming 80 is used for my router's web-interface. I currently have the Pi setup to use port 22, but again, it won't let me log in like normal.
  • I made sure my raspberry Pi has a static IP address.

I've been working on this for days, and I can't seem to find an answer. When it asks for a password, I tried entering the login information for my raspberry pi, but I also tried entering the login information for the router itself (username admin, password password) and it still didn't let me in. I looked in /var/log/auth.log, and I can't seem to find any entries for my failed login attempts (same goes for my router's logs). I have no idea where to go from here, so any advice is greatly appreciated. Let me know if you need any additional information.

Edit: This is what happens when I run ssh -v from a public network (public ip replaced with **.***.**.***):

ssh joe@**.***.**.*** -v
OpenSSH_7.2p2 Ubuntu-4ubuntu2.1, OpenSSL 1.0.2g 1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to **.***.**.*** [**.***.**.***] port 22.
debug1: Connection established.
debug1: identity file /home/joe/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/joe/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/joe/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/joe/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/joe/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/joe/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/joe/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/joe/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.1
debug1: Remote protocol version 2.0, remote software version ROSSSH
debug1: no match: ROSSSH
debug1: Authenticating to **.***.**.***:22 as 'joe'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: diffie-hellman-group-exchange-sha256
debug1: kex: host key algorithm: ssh-rsa
debug1: kex: server->client cipher: aes128-ctr MAC: hmac-sha1 compression: none
debug1: kex: client->server cipher: aes128-ctr MAC: hmac-sha1 compression: none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(2048<7680<8192) sent
debug1: got SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: got SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: ssh-rsa SHA256:TUSmUJR+Qrvk5OvlhBF2AMYxdp9LuOMbubbQzApRfVc
debug1: Host '**.***.**.***' is known and matches the RSA host key.
debug1: Found key in /home/joe/.ssh/known_hosts:4
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/joe/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /home/joe/.ssh/id_dsa
debug1: Trying private key: /home/joe/.ssh/id_ecdsa
debug1: Trying private key: /home/joe/.ssh/id_ed25519
debug1: Next authentication method: password
joe@**.***.**.***'s password:
debug1: Authentications that can continue: password
debug1: Next authentication method: password
Permission denied, please try again.
joe@**.***.**.***'s password:
debug1: Authentications that can continue: password
Permission denied, please try again.
joe@**.***.**.***'s password:
debug1: Authentications that can continue: password
debug1: No more authentication methods to try.
Permission denied (password).

The only files that are in ~/.ssh are id_rsa, id_rsa.pub, and known_hosts. This happens on the default port (22). When I try using the port that the router SHOULD be set up to forward, all I get is:

ssh joe@**.***.**.***:420 -v
OpenSSH_7.2p2 Ubuntu-4ubuntu2.1, OpenSSL 1.0.2g 1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
ssh: Could not resolve hostname **.***.**.***:420: Name or service not known

I also checked /etc/ssh/ssh_config. Most of the file is commented out, the only part that isn't looks like this:

SendEnv LANG LC_*
HashKnownHosts yes
GSSAPIAuthentication yes
GSSAPIDelegateCredentials no

Right now, I have the pi setup to take passwords in addition to passkeys, and it still doesn't want to let me in. The Pi is setup to use 22, but the router is setup to forward port 420 to the Pi's port 22. I've tried multiple ports on both the pi and the router, but none seem to work. All of my keys work just fine when I'm on the same network. Sorry for the long post, thanks for the help.

Edit 2: As a test, I decided to try ssh-ing while the raspberry pi was turned off to try and find out what was asking me for my password. Lo and behold, I was still prompted for a password like before even though the Raspberry Pi was turned off. I now need to figure out what I've been trying to log into this entire time.
The only other device on my network that could possibly have ssh running is my router, but I originally thought Netgear routers had SSH disabled by default. I tried logging into the router's IP address (192.168.1.1), and was immediately refused and disconnected. Aside from that, I don't know what else could possibly be asking for my password.
I am running out of ideas. I now know that the problem is with the network and router and not with the Raspberry Pi, and that my login attempts never made it to the Raspberry Pi at all, but where do I go from here? I have tried both port forwarding and UPnP, but neither of them worked. Is there anything else I could possibly try to fix this?

  • try to use the -v flag on ssh ssh -v publicIP to get some more information. Maybe you can try to change your config (for testing only) to password based authentication. One reason could be that there are some issues with your private key on the android phone... another option is to change the ports of the ssh deamon. – Joe Platano Apr 5 '17 at 5:24
  • Obviously you can connect, the problem is with your key in ConnectBot: Authentication method 'publickey' with key 'Piserver-keyy' failed – ElefantPhace Apr 6 '17 at 2:11
  • I'm able to connect just fine while on the network. Also, I have password authentication turned on, and my password doesn't work, either. – Banjoecommando Apr 6 '17 at 2:17
  • Are you sure you're using your correct external IP address? – ElefantPhace Apr 6 '17 at 11:15
  • I wondered the same thing. I've double checked my public IP hundreds of times, and I made sure my public IP is correct. – Banjoecommando Apr 6 '17 at 15:58

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.