1

I use to ssh to a remote server (no rsa-key, just password).

Now the server do not accept the connection any more and throw me this error:

ssh_exchange_identification: Connection closed by remote host

While I can google a little to find a fix I can't figure out what went wrong since I haven't touched anything on the machine since last login.

Can you help me find the cause?

EDIT: Inspecting the logs I've found these:

/var/auth.log
/var/log/auth.log:Dec 26 16:40:32 vps sshd[15567]: error: fork: Cannot allocate memory
/var/log/auth.log:Dec 26 16:41:05 vps sshd[15567]: error: fork: Cannot allocate memory
/var/log/auth.log:Dec 26 16:43:47 vps sshd[15567]: error: fork: Cannot allocate memory
/var/log/auth.log:Dec 27 03:20:06 vps sshd[15567]: error: fork: Cannot allocate memory
/var/log/auth.log:Dec 27 16:15:02 vps sshd[15567]: error: fork: Cannot allocate memory

And in the same span-time I've also found a lot of these:

/var/log/auth.log:Dec 26 13:00:01 vps CRON[1716]: PAM unable to dlopen(/lib/security/pam_unix.so): libcrypt.so.1: cannot map zero-fill pages: Cannot allocate memory
/var/log/auth.log:Dec 26 13:00:01 vps CRON[1716]: PAM adding faulty module: /lib/security/pam_unix.so

What are these?

8
  • This can mean anything. Most probably, the ssh server is crashing. In the distant past, this could be caused by a bad version of glibc. If it is indeed a crash, there must be some information in dmesh about the segfault.
    – AEP
    Dec 27 '10 at 13:26
  • Can you still log into it directly? What do the log files tell you? What does "ssh -V" tell you? Dec 27 '10 at 13:59
  • @AEP I've seen that caused by a rootkit too, one that replaces glibc. Dec 27 '10 at 14:05
  • I've insepected the logs and found something (I think). Ideas?
    – gbr
    Dec 27 '10 at 19:55
  • 2
    Looks like you're out of RAM. Can you run "free -m" or something to see if that's the case?
    – Bill Weiss
    Dec 27 '10 at 19:57
1

I run DenyHosts on my public ssh servers, and that's the error message I see when an IP has been added to /etc/hosts.deny.

Do you have any similar TCP wrapper services around your SSHd? Do you have a KVM or serial console to that box? Or can you SSH in from another server with a different IP?

5
  • I cannot SSH from another server too.
    – gbr
    Dec 27 '10 at 18:12
  • Got KVM? Serial Console? Dec 27 '10 at 19:11
  • Nope, it's a VPS. I've rebooted it and SSH againt (with success).
    – gbr
    Dec 27 '10 at 20:02
  • Anyway /ect/hosts.deny wasn't setted.
    – gbr
    Dec 27 '10 at 20:09
  • Hmm.. Probably SSHd being lame then. Is it running the latest versions of stuff? Dec 27 '10 at 21:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.