That error message gets triggered, among others, when the ssh client attempts a key-based login and offers more than MaxAuthTries
invalid keys. The SSH server will then break off the connection. That can either be caused by a (malicious) client that has no valid keys at all, or by valid users who simply have many different key-pairs and the MaxAuthTries
number is reached before the valid key can get exchanged. When that happens the connection will be terminated and won't even reach the stage where alternative login methods are offered/attempted.
(At the default log level) the ssh server doesn't record the failed keys that get exchanged/attempted and therefor the error message "error: maximum authentication attempts exceeded for ... ssh2 [preauth]
" seems to appear without any prior authentication attempts in the log file.
You can easily simulate that with:
Create a large number of disposable keys for testing:
for n in $(seq 1 10 ) ; do ssh-keygen -b 2048 -t rsa -f /tmp/sshkey-$n -q -N "" ; done
Use many -i
options to provide your ssh client possible keys:
ssh -v -i /tmp/sshkey-1 -i /tmp/sshkey-2 -i /tmp/sshkey-3 ... user@host
And you'll see the client offering one private key after another until the remote ssh daemon breaks off the connection:
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /tmp/sshkey-1
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Offering RSA public key: /tmp/sshkey-2
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Offering RSA public key: /tmp/sshkey-3
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Offering RSA public key: /tmp/sshkey-4
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Offering RSA public key: /tmp/sshkey-5
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Offering RSA public key: /tmp/sshkey-6
debug2: we sent a publickey packet, wait for reply
Received disconnect from hostn port 22:2: Too many authentication failures
Authentication failed
After attempting authentication with the 6th invalid key the connections gets refused. That corresponds with the default value for MaxAuthTries
setting in the sshd_config
configuration file which is 6.
In the security log the sshd daemon will only record:
sshd[19032]: error: maximum authentication attempts exceeded for login from 10.9.8.7 port 54956 ssh2 [preauth]
sshd[19032]: Disconnecting: Too many authentication failures [preauth]
Increasing the sshd_config LogLevel
to VERBOSE
will generate extra log event and when the failed keys do get logged the resulting "maximum authentication attempts exceeded ... Too many authentication failures" make a lot more sense:
sshd[19271]: Connection from 10.9.8.7 port 58823 on 10.9.8.8 port 22
sshd[19271]: Failed publickey for login from 10.9.8.7 port 58823 ssh2: RSA SHA256:QGnu...fpY
sshd[19271]: Failed publickey for login from 10.9.8.7 port 58823 ssh2: RSA SHA256:cjje...dDo
sshd[19271]: Failed publickey for login from 10.9.8.7 port 58823 ssh2: RSA SHA256:IIWe...d1M
sshd[19271]: Failed publickey for login from 10.9.8.7 port 58823 ssh2: RSA SHA256:xrQs...Et0
sshd[19271]: Failed publickey for login from 10.9.8.7 port 58823 ssh2: RSA SHA256:0Zln...UI4
sshd[19271]: Failed publickey for login from 10.9.8.7 port 58823 ssh2: RSA SHA256:hhsj...7Q4
sshd[19271]: error: maximum authentication attempts exceeded for login from 10.9.8.7 port 58823 ssh2 [preauth]
sshd[19271]: Disconnecting: Too many authentication failures [preauth]