20

I am running Ubuntu 10.10 on a remote box. I ssh to it everyday without issues but today out of the blue, I get the following error:

ssh_exchange_identification: Connection closed by remote host

If I connect with -vv, I get the following:

OpenSSH_5.6p1, OpenSSL 0.9.8r 8 Feb 2011
debug1: Reading configuration data /Users/bla/.ssh/config
debug1: Applying options for ubuntu-server
debug1: Reading configuration data /etc/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to ubuntu-server.com [123.123.123.123] port 22.
debug1: Connection established.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug2: key_type_from_name: unknown key type '-----END'
debug1: identity file /Users/bla/.ssh/id_rsa type -1
debug1: identity file /Users/bla/.ssh/id_rsa-cert type -1
ssh_exchange_identification: Connection closed by remote host

If I remove the key, I get the exact same output (sans "debug2: key_type_...). I've managed to log in physically and checked my hosts.allow and hosts.deny but they have no entries. I tried removing and reinstalling OpenSSH, checked authorized_keys and ~/.ssh permissions and tried connecting from other computers only to get the same error. I'm at my wits end, any help would be greatly appreciated.

7
  • 2
    Could you please post the output with -vvv and the permission of ~/.ssh folder and ~/.ssh/authorized_keys file?
    – quanta
    Commented Oct 30, 2011 at 7:05
  • 1
    Also, can you go and paste the sshd_config as well as host.allow/host.deny file? Incidentally, can you connect locally with: ssh localhost?
    – Rilindo
    Commented Oct 30, 2011 at 13:33
  • Does edoceo.com/notabene/ssh-exchange-identification this help?
    – chx
    Commented Oct 30, 2011 at 17:30
  • @quanta The -vvv log can be found in this gist, the permissions are drwx------ 2 user group 4096 2011-10-29 10:27 .ssh and -rw------- 1 user group 405 2011-10-29 10:20 authorized_keys2. @Rilindo my sshd_config and host.allow/deny can also be found in the gist. Thanks again for the help!
    – Carlos
    Commented Oct 30, 2011 at 19:22
  • 1
    I don't see the sshd_config - but how about this: run sshd on alternate port with the debug like so: /usr/sbin/sshd -p222 -d -f /etc/ssh/sshd_config
    – Rilindo
    Commented Oct 31, 2011 at 3:41

6 Answers 6

6

For me on CentOS7 it was caused by a lot of brute force login attempts coupled with the default setting of MaxStartups for sshd.

The manual page for sshd_config has this to say:

MaxStartups

Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. Additional connections will be dropped until authentication succeeds or the LoginGraceTime expires for a connection. The default is 10.

Alternatively, random early drop can be enabled by specifying the three colon separated values ''start:rate:full'' (e.g. "10:30:60"). sshd(8) will refuse connection attempts with a probability of ''rate/100'' (30%) if there are currently ''start'' (10) unauthenticated connections. The probability increases linearly and all connection attempts are refused if the number of unauthenticated connections reaches ''full'' (60).

Setting the start value to 25 (e.g., MaxStartups 25:30:100) in /etc/ssh/sshd_config resolved the issue.

3

It's almost certainly the /etc/hosts.deny file has an entry for your machine, add

sshd: xxx.yyy.zzz.aaa

for your connecting ip address to /etc/hosts.allow

2
  • doh! hoisted by my own petard, it seems Commented May 13, 2015 at 17:05
  • i have the exact same issue, is this solution on the client side? Commented Mar 11, 2021 at 17:41
3

The same error

ssh_exchange_identification: Connection closed by remote host

happens when private keys (files) are readable by all, i.e. have the wrong permissions.

For example, if any of the private keys

  • ssh_host_key
  • ssh_host_dsa_key
  • ssh_host_rsa_key

in /etc/ssh/ are chmod 644 (should be chmod 600).

The following permissions results in "ssh_exchange_identification: Connection closed by remote host" error:

root@host:/etc/config/ssh# ls -la
drwxrwxrwx    2 root     root            0 Aug 24  2005 .
drw-rw-rw-    3 root     root            0 Apr  3  2007 ..
-rw-r--r--    1 root     root        88039 Aug 24  2005 moduli
-rw-r--r--    1 root     root         1559 Aug 24  2005 ssh_config
-rw-r--r--    1 root     root          668 Aug 24  2005 ssh_host_dsa_key
-rw-r--r--    1 root     root          599 Aug 24  2005 ssh_host_dsa_key.pub
-rw-r--r--    1 root     root          524 Aug 24  2005 ssh_host_key
-rw-r--r--    1 root     root          328 Aug 24  2005 ssh_host_key.pub
-rw-r--r--    1 root     root          883 Aug 24  2005 ssh_host_rsa_key
-rw-r--r--    1 root     root          219 Aug 24  2005 ssh_host_rsa_key.pub
-rw-r--r--    1 root     root         2018 Aug 25  2005 sshd_config

Corrected permissions, connections should now be accepted:

root@host:/etc/config/ssh# ls -la                    
drwxrwxrwx    2 root     root            0 Aug 24  2005 .
drw-rw-rw-    3 root     root            0 Apr  3  2007 ..
-rw-r--r--    1 root     root        88039 Aug 24  2005 moduli
-rw-r--r--    1 root     root         1559 Aug 24  2005 ssh_config
-rw-------    1 root     root          668 Aug 24  2005 ssh_host_dsa_key
-rw-r--r--    1 root     root          599 Aug 24  2005 ssh_host_dsa_key.pub
-rw-------    1 root     root          524 Aug 24  2005 ssh_host_key
-rw-r--r--    1 root     root          328 Aug 24  2005 ssh_host_key.pub
-rw-------    1 root     root          883 Aug 24  2005 ssh_host_rsa_key
-rw-r--r--    1 root     root          219 Aug 24  2005 ssh_host_rsa_key.pub
-rw-r--r--    1 root     root         2018 Aug 25  2005 sshd_config
1
  • 1
    It'd be nice if it said "primary key pairs should not be world writeable" rather than "ssh_exchange_identification: Gobble De Goop" but spot on, this was the issue I encountered. Commented Jul 19, 2015 at 22:07
1
-rw------- 1 user group 405 2011-10-29 10:20 authorized_keys2

authorized_keys2 is deprecated from version 3.0.

debug3: Not a RSA1 key file /Users/bla/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace

It looks like your private key is corrupted. Regenerate the key pair, use ssh-copy-id to install your public key into authorized_keys file and try again.

1

Could there be a new firewall in between doing something. I have once faced a problem where in a new firewall which was introduced cased the exact same problem. The new firewall was introduced in the servers side.

0

There could be a couple of problems here.

  1. Is the server configured to restrict the types of authentication accepted? This can be set with the various *Authentication directives in your sshd_config file.
    • If you're using PAM for authentication, check its configuration
  2. It looks like your key is in some other format. Check out the ssh-keygen -e -i and -m flags.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .