Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a Ubuntu 12.04 server, I am getting the following pair of messages in auth.log several times a minute:

Jan 17 22:04:25 binx sshd[14659]: Connection closed by 192.168.0.1 [preauth]
Jan 17 22:04:25 binx sshd[14661]: Connection closed by 192.168.0.5 [preauth]

Both those IP addresses belong to separate computers (192.168.0.1 is our firewall/router, 192.168.0.5 is our backup machine), and seem to be associated with some sort of failed public key login. Is there some way to see what is causing the errors, or what user the machines are trying to connect to?

share|improve this question
up vote 0 down vote accepted

It turned out to be the result of a server move. Automated processes on those two servers ran into a host key failure, which was in turn the result of a new server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.