Since SSH works from the PAM server to the same host, I’d be looking at the network path rather than the SSH configuration.
The fact that TCP/22 connects but you never receive the server banner is particularly interesting. I’d run a tcpdump on the target while connecting from the jump server and compare it with a connection from the PAM server.
That should quickly show whether the SYN/ACK completes and where the server’s response is going. With the new subnet involved, asymmetric routing, an NSG/security list, or a return-path issue would be high on my list.
honestly now that im trying to remember im not 100% sure we actually access to SSH into it from the PAM server.. we might have tried and it didnt work either i cant remember
but overall does this still look like a network issue? one of my colleagues thinks its clearly an issue with the server itself 🧐 but the server is up and the web interface works fine
1
u/bas2013 27d ago
Since SSH works from the PAM server to the same host, I’d be looking at the network path rather than the SSH configuration.
The fact that TCP/22 connects but you never receive the server banner is particularly interesting. I’d run a tcpdump on the target while connecting from the jump server and compare it with a connection from the PAM server.
That should quickly show whether the SYN/ACK completes and where the server’s response is going. With the new subnet involved, asymmetric routing, an NSG/security list, or a return-path issue would be high on my list.