0

when I try to connect a specific server via ssh I get : Connection closed by 10.5.8.1 (more detail after)

I saw much error similar to mine, but the workaround that seems works with other, don't work here.

The workaround consists to reduce the Cipher options, to reduce the query/response stream between the server and the client. [1, 2 and much more, but I can't post more than 2 links...]

Here after my ~/.ssh/config

Host *
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials no
    Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc

Here the result of the ssh connection log

ssh -vvv -lmyLogon 10.5.8.1
OpenSSH_6.4, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /home/patrick/.ssh/config
debug1: /home/patrick/.ssh/config line 1: Applying options for *
debug3: cipher ok: aes128-ctr [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc]
debug3: cipher ok: aes192-ctr [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc]
debug3: cipher ok: aes256-ctr [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc]
debug3: cipher ok: arcfour256 [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc]
debug3: cipher ok: arcfour128 [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc]
debug3: cipher ok: aes128-cbc [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc]
debug3: cipher ok: 3des-cbc [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc]
debug3: ciphers ok: [aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc]
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 51: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 10.5.8.1 [10.5.8.1] port 22.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load "/home/patrick/.ssh/id_rsa" as a RSA1 public key
debug1: identity file /home/patrick/.ssh/id_rsa type 1
debug1: identity file /home/patrick/.ssh/id_rsa-cert type -1
debug3: Incorrect RSA1 identifier
debug3: Could not load "/home/patrick/.ssh/id_dsa" as a RSA1 public key
debug1: identity file /home/patrick/.ssh/id_dsa type 2
debug1: identity file /home/patrick/.ssh/id_dsa-cert type -1
debug1: identity file /home/patrick/.ssh/id_ecdsa type -1
debug1: identity file /home/patrick/.ssh/id_ecdsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.4
debug1: Remote protocol version 2.0, remote software version paramiko_1.10.0
debug1: no match: paramiko_1.10.0
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "10.5.8.1" from file "/home/patrick/.ssh/known_hosts"
debug3: load_hostkeys: loaded 0 keys
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1
debug2: kex_parse_kexinit: ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-sha1
debug2: kex_parse_kexinit: hmac-sha1
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-sha1
debug1: kex: server->client aes128-ctr hmac-sha1 none
debug2: mac_setup: found hmac-sha1
debug1: kex: client->server aes128-ctr hmac-sha1 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<7680<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 169/320
debug2: bits set: 3071/6144
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
Connection closed by 10.5.8.1

After a deletion in the ~/.ssh/know_hosts file via ssh-keygen -R 10.5.8.1 and a retry, I get a log like this one :

ssh -vvv -lmyLogon 10.5.8.1
OpenSSH_6.4, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /home/patrick/.ssh/config
debug1: /home/patrick/.ssh/config line 1: Applying options for *
debug3: cipher ok: aes256-ctr [aes256-ctr]
debug3: ciphers ok: [aes256-ctr]
debug2: mac_setup: found hmac-md5
debug3: mac ok: hmac-md5 [hmac-md5,hmac-sha1]
debug2: mac_setup: found hmac-sha1
debug3: mac ok: hmac-sha1 [hmac-md5,hmac-sha1]
debug3: macs ok: [hmac-md5,hmac-sha1]
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 51: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 10.5.8.1 [10.5.8.1] port 22.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load "/home/patrick/.ssh/id_rsa" as a RSA1 public key
debug1: identity file /home/patrick/.ssh/id_rsa type 1
debug1: identity file /home/patrick/.ssh/id_rsa-cert type -1
debug3: Incorrect RSA1 identifier
debug3: Could not load "/home/patrick/.ssh/id_dsa" as a RSA1 public key
debug1: identity file /home/patrick/.ssh/id_dsa type 2
debug1: identity file /home/patrick/.ssh/id_dsa-cert type -1
debug1: identity file /home/patrick/.ssh/id_ecdsa type -1
debug1: identity file /home/patrick/.ssh/id_ecdsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.4
debug1: Remote protocol version 2.0, remote software version paramiko_1.10.0
debug1: no match: paramiko_1.10.0
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "10.5.8.1" from file "/home/patrick/.ssh/known_hosts"
debug3: load_hostkeys: loaded 0 keys
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes256-ctr
debug2: kex_parse_kexinit: aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1
debug2: kex_parse_kexinit: ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-sha1
debug2: kex_parse_kexinit: hmac-sha1
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-sha1
debug1: kex: server->client aes256-ctr hmac-sha1 none
debug2: mac_setup: found hmac-sha1
debug1: kex: client->server aes256-ctr hmac-sha1 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<8192<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 260/512
debug2: bits set: 3010/6144
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: DSA 5b:d6:fa:56:9a:56:24:db:5a:1d:a3:22:95:6a:26:78
debug3: load_hostkeys: loading entries for host "10.5.8.1" from file "/home/patrick/.ssh/known_hosts"
debug3: load_hostkeys: loaded 0 keys
The authenticity of host '10.5.8.1 (10.5.8.1)' can't be established.
DSA key fingerprint is 5b:d6:fa:56:9a:56:24:db:5a:1d:a3:22:95:6a:26:78.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.5.8.1' (DSA) to the list of known hosts.
debug2: bits set: 3080/6144
debug1: ssh_dss_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
Connection closed by 10.5.8.1

Obviously I test with the default config, removing the entry for this server in my ~/.ssh/know_hosts file, tryed to find a lib named paramiko for ssh without success, tryed to put only one Cipher at a time... I had no more ideas.

I haven't access to the remote server. I'am on Linux pfa-fedora 3.16.6-200.fc20.i686 #1 SMP Wed Oct 15 13:48:38 UTC 2014 i686 i686 i386 GNU/Linux

Related to this StackOverflow issue

1 Answer 1

1

Had a similar problem and found a solution here.

It was related to the MTU configuration of the interface.

Somehow a smaller value makes it work. (It was 9001)

sudo ifconfig vpn0 mtu 576

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .