Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I use to ssh to a remote server (no rsa-key, just password).

Now the server do not accept the connection any more and throw me this error:

ssh_exchange_identification: Connection closed by remote host

While I can google a little to find a fix I can't figure out what went wrong since I haven't touched anything on the machine since last login.

Can you help me find the cause?

EDIT: Inspecting the logs I've found these:

/var/auth.log
/var/log/auth.log:Dec 26 16:40:32 vps sshd[15567]: error: fork: Cannot allocate memory
/var/log/auth.log:Dec 26 16:41:05 vps sshd[15567]: error: fork: Cannot allocate memory
/var/log/auth.log:Dec 26 16:43:47 vps sshd[15567]: error: fork: Cannot allocate memory
/var/log/auth.log:Dec 27 03:20:06 vps sshd[15567]: error: fork: Cannot allocate memory
/var/log/auth.log:Dec 27 16:15:02 vps sshd[15567]: error: fork: Cannot allocate memory

And in the same span-time I've also found a lot of these:

/var/log/auth.log:Dec 26 13:00:01 vps CRON[1716]: PAM unable to dlopen(/lib/security/pam_unix.so): libcrypt.so.1: cannot map zero-fill pages: Cannot allocate memory
/var/log/auth.log:Dec 26 13:00:01 vps CRON[1716]: PAM adding faulty module: /lib/security/pam_unix.so

What are these?

share|improve this question
    
This can mean anything. Most probably, the ssh server is crashing. In the distant past, this could be caused by a bad version of glibc. If it is indeed a crash, there must be some information in dmesh about the segfault. –  AEP Dec 27 '10 at 13:26
    
Can you still log into it directly? What do the log files tell you? What does "ssh -V" tell you? –  Paul Tomblin Dec 27 '10 at 13:59
    
@AEP I've seen that caused by a rootkit too, one that replaces glibc. –  Tom O'Connor Dec 27 '10 at 14:05
    
I've insepected the logs and found something (I think). Ideas? –  lbwtz2 Dec 27 '10 at 19:55
2  
Looks like you're out of RAM. Can you run "free -m" or something to see if that's the case? –  Bill Weiss Dec 27 '10 at 19:57

1 Answer 1

I run DenyHosts on my public ssh servers, and that's the error message I see when an IP has been added to /etc/hosts.deny.

Do you have any similar TCP wrapper services around your SSHd? Do you have a KVM or serial console to that box? Or can you SSH in from another server with a different IP?

share|improve this answer
    
I cannot SSH from another server too. –  lbwtz2 Dec 27 '10 at 18:12
    
Got KVM? Serial Console? –  Tom O'Connor Dec 27 '10 at 19:11
    
Nope, it's a VPS. I've rebooted it and SSH againt (with success). –  lbwtz2 Dec 27 '10 at 20:02
    
Anyway /ect/hosts.deny wasn't setted. –  lbwtz2 Dec 27 '10 at 20:09
    
Hmm.. Probably SSHd being lame then. Is it running the latest versions of stuff? –  Tom O'Connor Dec 27 '10 at 21:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.