# Linuxmuster-setup läuft nicht durch (SSH-Verbindung zur Firewall) **URL:** \ **Category:** Server\ **Created:** [5. Juni 2022 um 03:04 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918 "2022-06-05T03:04:39Z")\ **Posts on this page:** 20\ **Page:** 4
**Author:** ![Michael](https://ask.linuxmuster.net/user_avatar/ask.linuxmuster.net/michael/32/59_2.png) [@Michael](https://ask.linuxmuster.net/u/Michael)\ **Post date:** [17. Mai 2025 um 07:53 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/61 "2025-05-17T07:53:26Z")
Good luck. I saw that your domainname is a FQDN, so: external name = internal name, right? As I use Let’s encrypt certificates for our server I need to copy the certificate (via cronjob) to this directory. Maybe there’s the problem in your setup?? Greetings, Michael ---
**Author:** ![Fenyo](https://ask.linuxmuster.net/letter_avatar_proxy/v4/letter/f/7ba0ec/32.png) [@Fenyo](https://ask.linuxmuster.net/u/Fenyo)\ **Post date:** [18. Mai 2025 um 09:55 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/62 "2025-05-18T09:55:55Z")
Thanks, No, the domain name is just an internal address, so it’s not fqdn, I tried eltetrefort.lan and [eltetrefort.org](http://eltetrefort.org) to see if it matters, I used the former under Linuxschools without problems and the latter under Sambaedu, so I guess the domain name alone shouldn’t be a problem. Our external ip address itself and our name resolver are part of a larger organisation (ELTE University, the external ip 157.181.x.x all belong to it), it is important to use their 157.181.3.1 (or 157.181.42.42) name resolver, as it will translate a lot of things inwards (mostly elte. hu), which is the only way to get it to work correctly, and this hasn’t caused any problems for Linuxschools and Sambaedu either, but hopefully we’ll be smarter on Monday when I’ll look into the above you suggested. ---
**Author:** ![Michael](https://ask.linuxmuster.net/user_avatar/ask.linuxmuster.net/michael/32/59_2.png) [@Michael](https://ask.linuxmuster.net/u/Michael)\ **Post date:** [18. Mai 2025 um 11:39 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/63 "2025-05-18T11:39:27Z")
Ok … just a few ideas: You can also check ` journalctl -u samba-ad-dc` for more detailed log-files. Or you can increase the log-level for Samba here: ```auto cd /etc/samba/ mcedit smb.conf --> #Normal Mode (deactivate this entry): log level = 1 auth_audit:3 # Debug-Mode (increase from 1 to 3 and activate this): #log level = 3 passdb:5 auth:5 auth_audit:3 ``` … and of course ```auto systemctl restart samba-ad-dc ``` Good luck. ---
**Author:** ![Fenyo](https://ask.linuxmuster.net/letter_avatar_proxy/v4/letter/f/7ba0ec/32.png) [@Fenyo](https://ask.linuxmuster.net/u/Fenyo)\ **Post date:** [19. Mai 2025 um 07:04 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/64 "2025-05-19T07:04:00Z")
Hello, The contents of the samba.conf file also confirms that the server cert.pem key is not/has not been created, which is not helped by the cert renewal script mentioned above. So the origin of the problem has been identified, question how to proceed from here? ![20250519_083735](https://ask.linuxmuster.net/uploads/default/original/2X/0/06cf8072547c3c370c856a3bb9bcb92e4026aee0.jpeg) ![20250519_083940](https://ask.linuxmuster.net/uploads/default/original/2X/2/26f8ae30652bc993e3b396a3bacc673c2d791712.jpeg) ![20250519_085148](https://ask.linuxmuster.net/uploads/default/original/2X/b/b9858f4aa9808988acd6ee5ba905313e481762c9.jpeg) Thanks, Fenyő ---
**Author:** ![Michael](https://ask.linuxmuster.net/user_avatar/ask.linuxmuster.net/michael/32/59_2.png) [@Michael](https://ask.linuxmuster.net/u/Michael)\ **Post date:** [19. Mai 2025 um 07:34 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/65 "2025-05-19T07:34:38Z")
Hm – that’s strange … did you check the rights and the size of the files in `/etc/linuxmuster/ssl`? Here: ```auto -rw-r--r-- 1 root ssl-cert 7253 Mai 15 04:06 server.cert.bundle.pem -rw-r--r-- 1 root ssl-cert 374 Apr 21 18:08 server_cert_ext.cnf -rw-r----- 1 root ssl-cert 2208 Mai 15 04:06 server.cert.pem -rw-r----- 1 root ssl-cert 1724 Mai 15 04:06 server.csr -rw------- 1 root ssl-cert 3243 Mai 15 04:06 server.key.pem ``` and: ```auto cat server.cert.bundle.pem ``` starts with ```auto -----BEGIN CERTIFICATE----- MIIGM .... ``` Are the rights and owner of your files correct? (-rw-(r)–(r)-- and root:ssl-cert)? (`ls -la * /etc/linuxmuster/ssl `) If you just need to create a new (self-signed) certificate you can also follow these instructions (but of course it should work with `linuxmuster-renew-certs` as wel) : [https://arminreiter.com/2022/01/create-your-own-certificate-authority-ca-using-openssl/](https://arminreiter.com/2022/01/create-your-own-certificate-authority-ca-using-openssl/) ---
**Author:** ![Fenyo](https://ask.linuxmuster.net/letter_avatar_proxy/v4/letter/f/7ba0ec/32.png) [@Fenyo](https://ask.linuxmuster.net/u/Fenyo)\ **Post date:** [19. Mai 2025 um 08:07 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/66 "2025-05-19T08:07:15Z")
yes the permissions seem to be ok in the ssl directory and the contents of the bundle file are readable. the renew script does nothing unfortunately. The manual solution if I understand correctly creates a crt and key file, but I’m lost from the fourth step, we don’t have a webserver, or rather we don’t run our website, but on a server of ELTE. ![20250519_094722](https://ask.linuxmuster.net/uploads/default/original/2X/b/b08c790b67ea97276b817cccf0a1565dff81b61c.jpeg) ---
**Author:** ![Michael](https://ask.linuxmuster.net/user_avatar/ask.linuxmuster.net/michael/32/59_2.png) [@Michael](https://ask.linuxmuster.net/u/Michael)\ **Post date:** [19. Mai 2025 um 09:01 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/67 "2025-05-19T09:01:25Z")
That’s the problem … your bundle does not consist of the certificate AND the key but ONLY of the key. (and you don’t need the steps for the webserver … just the recreation of the server-cert and the bundle) ---
**Author:** ![Fenyo](https://ask.linuxmuster.net/letter_avatar_proxy/v4/letter/f/7ba0ec/32.png) [@Fenyo](https://ask.linuxmuster.net/u/Fenyo)\ **Post date:** [19. Mai 2025 um 09:21 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/68 "2025-05-19T09:21:04Z")
Yes, the key pairs were not created during the installation, that’s clear and for some reason the renew script can’t create them either. With this manual method I can create a crt and a key file, but it is not clear if I should then rewrite the smb.conf file or rename the created files and then rename key to pem or which of the 2 files created should be which? ---
**Author:** ![Michael](https://ask.linuxmuster.net/user_avatar/ask.linuxmuster.net/michael/32/59_2.png) [@Michael](https://ask.linuxmuster.net/u/Michael)\ **Post date:** [19. Mai 2025 um 10:40 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/69 "2025-05-19T10:40:57Z")
Ok, I think both ways should be possible. But the easiest and best way should be to keep the entries and **rename** files. Else you will have the same problem later with the file ```auto /etc/linuxmuster/api]$ cat config.yml ``` There’s also the filename `ssl_certfile: /etc/linuxmuster/ssl/server.cert.bundle.pem` (it’s no problem to rename a crt to pem by the way … → [https://stackoverflow.com/questions/63195304/difference-between-pem-crt-key-files](https://stackoverflow.com/questions/63195304/difference-between-pem-crt-key-files) ) In your case I would try ```auto cat trefortserver.fullchain.pem trefortserver.key.pem > trefortserver.cert.bundle.pem ``` to recreate the new bundle-file. Afterwards: `chown root:ssl-cert trefortserver.cert.bundle.pem` and of course `systemctl restart samba-ad-dc` and see if it works with a new certificate… 🤔 ⁉ ---
**Author:** ![Fenyo](https://ask.linuxmuster.net/letter_avatar_proxy/v4/letter/f/7ba0ec/32.png) [@Fenyo](https://ask.linuxmuster.net/u/Fenyo)\ **Post date:** [19. Mai 2025 um 12:53 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/70 "2025-05-19T12:53:01Z")
There is no /etc/linuxmuster/api directory, is this again cause or effect? The trefortserver.cert.pem file is missing in samba, the bundle and fullchain files exist, so I don’t really understand the proposed merge. Based on the linked description I can generate a crt and a key file, if renaming them would work, which one should I rename to which? Also, I noticed in systemctl that the quota service is not running alongside samba, but I guess this will be an depend of samba. ---
**Author:** ![Michael](https://ask.linuxmuster.net/user_avatar/ask.linuxmuster.net/michael/32/59_2.png) [@Michael](https://ask.linuxmuster.net/u/Michael)\ **Post date:** [19. Mai 2025 um 13:36 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/71 "2025-05-19T13:36:01Z")
Hi. Ok, the bundle-file exists … but it does not contain all needed parts as far as I see it 🤷‍♂️ . The `server.cert.bundle.pem` consists of three parts: ```auto -----BEGIN CERTIFICATE----- bla bla -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- bla bla -----END CERTIFICATE----- -----BEGIN RSA PRIVATE KEY----- bla bla -----END RSA PRIVATE KEY----- ``` but in your case this file has exactly the same size than `trefortserver.key.pem` – so something is wrong with this bundle (in my opinion). That’s why I suggested to append all three files (with the cat-Command) to **one** file: `cat trefortserver.fullchain.pem trefortserver.key.pem > trefortserver.cert.bundle.pem` Can you give it a try? ---
**Author:** ![Fenyo](https://ask.linuxmuster.net/letter_avatar_proxy/v4/letter/f/7ba0ec/32.png) [@Fenyo](https://ask.linuxmuster.net/u/Fenyo)\ **Post date:** [19. Mai 2025 um 13:41 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/72 "2025-05-19T13:41:18Z")
In the meantime I reinstalled the linuxmuster api package so it now appears under /etc/linuxmuster. Yes, but which third file should I add, the above two didn’t work, it still misses trefortserver.cert.pem, which doesn’t exist. ![20250519_153555](https://ask.linuxmuster.net/uploads/default/original/2X/b/b9853aac257e9cb1fbb16751770f6db0da7bb84c.jpeg) ---
**Author:** ![Michael](https://ask.linuxmuster.net/user_avatar/ask.linuxmuster.net/michael/32/59_2.png) [@Michael](https://ask.linuxmuster.net/u/Michael)\ **Post date:** [19. Mai 2025 um 13:46 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/73 "2025-05-19T13:46:38Z")
I’m still a bit confused by the names … now the cert is called `lmnapi.pem`? > [@Fenyo](#): > > Yes, but which third file should I add, the above two didn’t work, it still misses trefortserver.cert.pem, which doesn’t exist. `cat trefortserver.fullchain.pem trefortserver.key.pem > trefortserver.cert.bundle.pem` The fullchain should consist of **two** parts … and the key is the **third** part. These three parts are copied to the bundle-file … ---
**Author:** ![Fenyo](https://ask.linuxmuster.net/letter_avatar_proxy/v4/letter/f/7ba0ec/32.png) [@Fenyo](https://ask.linuxmuster.net/u/Fenyo)\ **Post date:** [19. Mai 2025 um 13:52 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/74 "2025-05-19T13:52:37Z")
This is the content of the api directory (lmnapi.pem) you asked me to list above. Unfortunately, the 2 files concatenated to bundle.pem do not work (permissions set of course), and the cert.pem file is still missing in samba. ---
**Author:** ![Fenyo](https://ask.linuxmuster.net/letter_avatar_proxy/v4/letter/f/7ba0ec/32.png) [@Fenyo](https://ask.linuxmuster.net/u/Fenyo)\ **Post date:** [19. Mai 2025 um 14:27 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/75 "2025-05-19T14:27:05Z")
I even found this in the setup.final.log, ovsdb-server.service is not running on the opnsene, but I don’t see a service with that name under the plugins tab. ![20250519_162348](https://ask.linuxmuster.net/uploads/default/original/2X/3/3fed759dceadd79b6044496f4a6f2026dde27a14.jpeg) ---
**Author:** ![baumhof](https://ask.linuxmuster.net/user_avatar/ask.linuxmuster.net/baumhof/32/1504_2.png) [@baumhof](https://ask.linuxmuster.net/u/baumhof)\ **Post date:** [19. Mai 2025 um 14:42 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/76 "2025-05-19T14:42:45Z")
Hi Fenyo, your IP setup is a bit unusual. We use 10.0.0.0/24 most often. Is there a reason to use that? Are you sure that there is no such Net outside your OPNsense in your Network? Did you install the OPNsense wit a „blue“ Network? What IP Net do you have there? Yours Holger ---
**Author:** ![Fenyo](https://ask.linuxmuster.net/letter_avatar_proxy/v4/letter/f/7ba0ec/32.png) [@Fenyo](https://ask.linuxmuster.net/u/Fenyo)\ **Post date:** [19. Mai 2025 um 16:07 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/77 "2025-05-19T16:07:13Z")
Hello, Mostly I use 172.16.0.0/16 for inherited stuff, because the printers and other servers (openmediavault, camera systems etc) are here and it would be a pain to change the ip addresses of the installed printers on a hundreds of clients, and importing clients would be easier this way. And using 172. 16.0.254 is not used because it has a switch administration ip address (of course I can clean it up elsewhere if necessary) , so I arbitrarily made 172.16.0.11 the address of the lan leg of opnsense. Unfortunately I don’t know what the term „blue“ network means. First I had only one opnsense with the wan leg set directly to the fixed external ip address of the provider (ELTE). Its gateway was always overwritten by the websetup to the internal leg of the opnsense, which could be reset, but nameserver is always a problem, the lmn sets it to itself, but it can’t resolve anything on the fly, only if I add another nameserver, but then the lmn is not accessible from client to browser anymore. So I obtained a router, on the one hand, to test separately on another network regardless of the time, and on the other hand, the gateway configuration problem is gone, „only“ namserver remains. Of course I can try it with default ip settings to see if it makes a difference. ---
**Author:** ![Fenyo](https://ask.linuxmuster.net/letter_avatar_proxy/v4/letter/f/7ba0ec/32.png) [@Fenyo](https://ask.linuxmuster.net/u/Fenyo)\ **Post date:** [20. Mai 2025 um 06:17 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/78 "2025-05-20T06:17:18Z")
Before reinstalling deafult ip addressing, I checked what the command line setup says, and it also misses trefortsetver.cert.pem file, so this seems to be the root of the problem. ![20250520_081050](https://ask.linuxmuster.net/uploads/default/original/2X/2/27fd13001a76862261248532bce2d2a38370295c.jpeg) ---
**Author:** ![Fenyo](https://ask.linuxmuster.net/letter_avatar_proxy/v4/letter/f/7ba0ec/32.png) [@Fenyo](https://ask.linuxmuster.net/u/Fenyo)\ **Post date:** [20. Mai 2025 um 09:14 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/79 "2025-05-20T09:14:26Z")
I checked then with default ip addressing (10.0.0.1 server 10.0.0.254 opnsense lan), but it doesn’t make any difference, so as you would expect the default ip addressing can be changed, the problem in my case is that the server ssl authentication keys are not generated during installation and the renew script can’t generate them either. It could be tried manually in principle, but unfortunately I don’t know how to do that, so I’m stuck here. What I can try is to do an installation at home to see if the problem exists from another wan network. ---
**Author:** ![Michael](https://ask.linuxmuster.net/user_avatar/ask.linuxmuster.net/michael/32/59_2.png) [@Michael](https://ask.linuxmuster.net/u/Michael)\ **Post date:** [20. Mai 2025 um 10:43 UTC](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918/80 "2025-05-20T10:43:27Z")
> [@Fenyo](#): > > the problem in my case is that the server ssl authentication keys are not generated Hi. I don’t know why … but you can generate new ones manually … the v7-Server is alreaday a CA by itself. **Step 1:** Generate `trefortserver.csr` (CERTIFICATE REQUEST) and `trefortserver.key.pem` (PRIVATE KEY) ```auto openssl req -new -nodes -out trefortserver.csr -newkey rsa:4096 -keyout trefortserver.key.pem -subj '/CN=Self-Signed-Cert/C=DE/ST=NDS/L=Location/O=Organisation' ``` **Step 2:** Find the CA pass phrase ```auto cd /etc/linuxmuster/.secret cat cakey ``` **Step 3:** Sign the certificate ```auto cd /etc/linuxmuster/ssl ``` ← there should be the CA-Cert and the CA-Key (maybe with different names than shown here?! If these files are present … create the missing cert manually: ```auto openssl x509 -req -in trefortserver.csr -CA cacert.crt -CAkey cakey.pem -CAcreateserial -out trefortserver.cert.pem -sha256 ``` … this command should do the job and create a new self-signed cert named trefortserver.cert.pem. Afterwards you can create the bundle-File… Does this work? Check the new certificate with ```auto openssl x509 -in trefortserver.cert.pem -text -noout ``` Good luck. Michael [Vorherige Seite](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918.md?page=3) [Nächste Seite](https://ask.linuxmuster.net/t/linuxmuster-setup-laeuft-nicht-durch-ssh-verbindung-zur-firewall/8918.md?page=5)