746044 - Cannot ssh to hg.mozilla.org from some build slaves

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps: DC ACL Request, task)

Description

[Rail Aliiev [:rail]]

Preproduction release use some ssh based commands to remove/clone repos on hg.m.o. The operation has been failing these days:

# HOSTNAME=moz2-linux-slave51
$ ssh -v  -l prepr-ffxbld -i ~cltbld/.ssh/ffxbld_dsa hg.mozilla.org edit af delete YES
OpenSSH_4.3p2, OpenSSL 0.9.8b 04 May 2006
debug1: Reading configuration data /home/cltbld/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to hg.mozilla.org [63.245.215.25] port 22.
debug1: connect to address 63.245.215.25 port 22: Connection timed out
ssh: connect to host hg.mozilla.org port 22: Connection timed out

I tried to connect using linux64-ix-slave06 and it worked fine (a noop connection, since this is a production slave).

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

[root@moz2-linux-slave51 ~]# facter ipaddress
10.2.90.131
[root@moz2-linux-slave51 ~]# host hg.mozilla.org
hg.mozilla.org has address 63.245.215.25
[root@moz2-linux-slave51 ~]# nc -vz 63.245.215.25 80
Connection to 63.245.215.25 80 port [tcp/http] succeeded!
[root@moz2-linux-slave51 ~]# nc -vz 63.245.215.25 22

So looks like we need to update flows.

Comment 2

[casey ransom [:casey]]

fwsm updated to allow 215.25:22. dustin confirmed ssh open.

-casey