Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When I try to connect to remote server, ssh asks for password, checks it (if I put wrong password it will say "Permission denied") but doesn't let me in:

$ ssh user11@123
user11@123's password:

nothing happens, and some time later:

Read from remote host 123: Connection reset by peer

123 is hided server's ip.

Both ssh and sftp do this.

Remote is linux+OpenSSH and week ago ssh worked ok.

in -vvv mode I have after entry of password

debug3: packet_send2: adding 64 (len 58 padlen 6 extra_pad 64)
debug2: we sent a password packet, wait for reply
debug1: Authentication succeeded (password).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug1: Entering interactive session.

after some time...

debug1: channel 0: free: client-session, nchannels 1
debug3: channel 0: status: The following connections are open:
  #0 client-session (t3 r-1 i0/0 o0/0 fd 4/5 cfd -1)

debug3: channel 0: close_fds r 4 w 5 e 6 c -1
Read from remote host 123: Connection reset by peer
debug1: Transferred: stdin 0, stdout 0, stderr 63 bytes in 117.1 seconds
debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 0.5
share|improve this question
    
Anything in /var/log/secure on the server? –  faker Nov 26 '11 at 19:11
    
faker, there is no access to the server, it is remote (without remote console). –  osgx Nov 26 '11 at 19:14
add comment

1 Answer

up vote 1 down vote accepted

There can be a few different causes of this, there's not enough information here to narrow down the problem exactly.

You'd have to check in your various log files on the server "123" in /var/log to see what's going on. This means checking out its console if you can't SSH to it.

An (incomplete) list of possible causes might be:

  • Some kind of runaway processes on your server filling up your process table, meaning it can't spawn your shell
  • Not enough RAM to spawn a shell.
  • Hard disk failure, meaning it can not load your shell from disk even though sshd might still be alive.
  • Your login shell set incorrectly to /bin/false or something
  • Somebody felt it would be funny to rm -rf / your server.
  • Some script kiddie tried to install a rootkit but botched it up to the degree that a shell won't launch.

Either way you're going to have to go to the console of the server to see what might be going on.

share|improve this answer
    
Server is remote... Does sftp require spawning too? My login was ok week ago; also there is huge time between password accept and disconnect. –  osgx Nov 26 '11 at 19:14
1  
I think sftp will also require some kind of process to be spawned on the server after successful login, but I'm not certain. You might try using scp rather than sftp, although I'm not sure if that would help. Perhaps you can scp down a copy of /var/log/messages –  Per von Zweigbergk Nov 26 '11 at 19:18
    
scp don't work too: "... password: debug3: packet_send2: adding 64 (len 58 padlen 6 extra_pad 64) debug2: we sent a password packet, wait for reply " and nothing happens again. May be disk fault of /var/log/wtmp? –  osgx Nov 26 '11 at 19:23
    
It might well be a disk fault, although if it were just a disk fault, I'm surprised that logging in still works, perhaps something is caching a copy of /etc/shadow in memory or something. Either way, anything we'll be able to come up like this is just speculation. It could just as well be a hacker attack. Do you have any other services running on the machine, or does it only do SSH? –  Per von Zweigbergk Nov 26 '11 at 19:30
    
Per von Zweigbergk, as I know there is only SSH accessible from internet. There are internal services like webserver. And any access to internal network is only via this server. –  osgx Nov 26 '11 at 21:06
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.