Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having a really annoying problem on my Ubuntu laptop.

I noticed it today, after upgrading to Ubuntu 11.04, although I'm not entirely sure this is the cause as I played with my ssh keys a few days ago.

The problem is, whenever I try to ssh to ANY host I get the following error:

Read from socket failed: Connection reset by peer

running with -vvv gives the following output:

OpenSSH_5.8p1 Debian-1ubuntu3, OpenSSL 0.9.8o 01 Jun 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to hostname [10.0.0.2] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_4.2
debug1: match: OpenSSH_4.2 pat OpenSSH_4*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.8p1 Debian-1ubuntu3
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "hostname" from file "/root/.ssh/known_hosts"
debug3: load_hostkeys: loaded 0 keys
debug1: SSH2_MSG_KEXINIT sent
Read from socket failed: Connection reset by peer

My /etc/ssh/ssh_config:

Host *
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication no
    GSSAPIDelegateCredentials no

I can connect to my laptop from any other server via ssh, and I can also ssh localhost from my laptop successfully.

I can connect to all these other server from other laptops, and I don't see anything in the logs of the other servers regarding my failed attempt.

I tried to stop iptables, didn't help.

I tried several tricks I could find online with my /etc/ssh/ssh_config, but I was unsuccessful in solving the problem...

Any ideas?


Edit: This is the log from one of the hosts I try to connect to:

May  1 19:15:23 localhost sshd[2845]: debug1: Forked child 2847.
May  1 19:15:23 localhost sshd[2845]: debug3: send_rexec_state: entering fd = 8 config len 577
May  1 19:15:23 localhost sshd[2845]: debug3: ssh_msg_send: type 0
May  1 19:15:23 localhost sshd[2845]: debug3: send_rexec_state: done
May  1 19:15:23 localhost sshd[2847]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8
May  1 19:15:23 localhost sshd[2847]: debug1: inetd sockets after dupping: 3, 3
May  1 19:15:23 localhost sshd[2847]: Connection from 10.0.0.7 port 55747
May  1 19:15:23 localhost sshd[2847]: debug1: Client protocol version 2.0; client software version OpenSSH_5.8p1 Debian-1ubuntu3
May  1 19:15:23 localhost sshd[2847]: debug1: match: OpenSSH_5.8p1 Debian-1ubuntu3 pat OpenSSH*
May  1 19:15:23 localhost sshd[2847]: debug1: Enabling compatibility mode for protocol 2.0
May  1 19:15:23 localhost sshd[2847]: debug1: Local version string SSH-2.0-OpenSSH_5.3
May  1 19:15:23 localhost sshd[2847]: debug2: fd 3 setting O_NONBLOCK
May  1 19:15:23 localhost sshd[2847]: debug2: Network child is on pid 2848
May  1 19:15:23 localhost sshd[2847]: debug3: preauth child monitor started
May  1 19:15:23 localhost sshd[2847]: debug3: mm_request_receive entering
May  1 19:15:23 localhost sshd[2848]: debug3: privsep user:group 74:74
May  1 19:15:23 localhost sshd[2848]: debug1: permanently_set_uid: 74/74
May  1 19:15:23 localhost sshd[2848]: debug1: list_hostkey_types: ssh-rsa,ssh-dss
May  1 19:15:23 localhost sshd[2848]: debug1: SSH2_MSG_KEXINIT sent
May  1 19:15:23 localhost sshd[2848]: debug3: Wrote 784 bytes for a total of 805
May  1 19:15:23 localhost sshd[2848]: fatal: Read from socket failed: Connection reset by peer
share|improve this question
    
any chances to see one of the ssh servers log? –  hmontoliu May 1 '11 at 16:30
    
which log? I didn't see anything written when I tried to connect (polled ls -ltr on /var/log and nothing changed after the failed connection) –  yonix May 1 '11 at 16:41
    
@yonix: man sshd_config; check the LogLevel setting –  hmontoliu May 1 '11 at 16:51
    
@hmontoliu: Oh... Good to know. Unfortunately I don't have root access to these servers. But I'll try and have someone help me with it tomorrow maybe. –  yonix May 1 '11 at 17:21
    
What is the output of iptables -L -v? –  justarobert May 1 '11 at 18:15
show 4 more comments

closed as off-topic by Falcon Momot, Rex, kce, cole, growse Dec 4 '13 at 14:10

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – Falcon Momot, Rex, kce, cole, growse
If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers

up vote 7 down vote accepted

That's a tough-to-debug one in openssh, It seems to happen only from particular clients to particular servers.

  1. Cause? I didn't get to the root cause. My best finding is that the connection packets are too big for the server to handle, and the connection is reset.

  2. Workarounds: limit the packet size. Two alternatives:

    • Limit cipher list length by using '-c ' in the ssh command line, e.g. '-c aes256-ctr'
    • Limit HostKeyAlgorithms list by adding to ~/.ssh/config:

      HostKeyAlgorithms ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss

  3. URLs:

  4. Affected versions: AFAIK it started with 5.7p1. Downgrading to 5.5p1 solves the problem. However, on machines that do NOT have this problem, 5.7p1, 5.8p1 work perfectly. Thus my assumption is that it has to do with an innocent library call that was added on 5.7p1 to a 3rd party lib, which is broken only on certain environments. Crazy assumption to a crazy bug.

share|improve this answer
    
Also the Debian bug URL: bugs.debian.org/cgi-bin/bugreport.cgi?bug=612607 –  Mar_Garina May 2 '11 at 8:55
    
Amazing dude! You saved my ass! :) –  yonix May 2 '11 at 8:59
    
Btw, the guys on openssh-unix-dev show interest in fixing this bug. The problem is that nobody so far cam up with a 100% working recipe for reproducing the bug on other environments. –  Mar_Garina May 2 '11 at 9:05
add comment

This worked for me:

My /etc/ssh/ssh_config:

Host *

SendEnv LANG LC_*

HashKnownHosts yes

GSSAPIAuthentication yes

GSSAPIDelegateCredentials no

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc

That's because connection packets are too big for the server to handle, and the connection is reset. You can put Chippers config in /etc/ssh/ssh_config ... so just try with ssh -l username hotname no need for -c aes256-ctr anymore.

share|improve this answer
add comment

I found this error to occur when I was on a specific wifi connection. When I changed to a different wifi, the error went away. Weird, but real :-/

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.