Ubuntu – Out of nowhere, ssh_exchange_identification: Connection closed by remote host

sshUbuntu

I am running Ubuntu 10.10 on a remote box. I ssh to it everyday without issues but today out of the blue, I get the following error:

ssh_exchange_identification: Connection closed by remote host

If I connect with -vv, I get the following:

OpenSSH_5.6p1, OpenSSL 0.9.8r 8 Feb 2011
debug1: Reading configuration data /Users/bla/.ssh/config
debug1: Applying options for ubuntu-server
debug1: Reading configuration data /etc/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to ubuntu-server.com [123.123.123.123] port 22.
debug1: Connection established.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug2: key_type_from_name: unknown key type '-----END'
debug1: identity file /Users/bla/.ssh/id_rsa type -1
debug1: identity file /Users/bla/.ssh/id_rsa-cert type -1
ssh_exchange_identification: Connection closed by remote host

If I remove the key, I get the exact same output (sans "debug2: key_type_…). I've managed to log in physically and checked my hosts.allow and hosts.deny but they have no entries. I tried removing and reinstalling OpenSSH, checked authorized_keys and ~/.ssh permissions and tried connecting from other computers only to get the same error. I'm at my wits end, any help would be greatly appreciated.

Best Answer

For me on CentOS7 it was caused by a lot of brute force login attempts coupled with the default setting of MaxStartups for sshd.

The manual page for sshd_config has this to say:

MaxStartups

Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. Additional connections will be dropped until authentication succeeds or the LoginGraceTime expires for a connection. The default is 10.

Alternatively, random early drop can be enabled by specifying the three colon separated values ''start:rate:full'' (e.g. "10:30:60"). sshd(8) will refuse connection attempts with a probability of ''rate/100'' (30%) if there are currently ''start'' (10) unauthenticated connections. The probability increases linearly and all connection attempts are refused if the number of unauthenticated connections reaches ''full'' (60).

Setting the start value to 25 (e.g., MaxStartups 25:30:100) in /etc/ssh/sshd_config resolved the issue.

Related Topic