Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #245027

Re: OpenSSH: cause of random kex_exchange_identification errors?

Show all headers | View raw

On Wed, 02 Feb 2022, Vincent Lefevre wrote:
> When I want to connect with SSH (ssh/scp) to some machine, I sometimes
> get errors, either
> 
> kex_exchange_identification: Connection closed by remote host
> 
> or
> 
> kex_exchange_identification: read: Connection reset by peer

That's a very early stage of the initial connection, and your SSH client
just noticed the remote server (or some middle box like a firewall, or
oversubscribed NAT gateway) dropped the TCP connection for whatever
reason.

It will be related to the TCP connection itself, and nothing else. IP
protocol family/address/port, or something in the TCP path misbehaving.

The most common reason is that the remote server disliked your IP
address and/or port due to /etc/hosts.allow/deny, firewalling, or
something in sshd_config.  Ensure you check both IPv4 and IPv6.

> The admin of the machine could see nothing particular in the logs.
> He eventually modified the MaxStartups value, but this did not
> solve the issue (but AFAIK, if this were the cause, there would
> have been something about it in the logs). The machine has enough
> available memory.
> 
> Any idea about the possible cause of these random errors?

The debugging needs to be done either in the server side, or on *both*
sides.

If you're using socket-forwarding stuff in the client side, check that.
This is exceedingly rare nowadays, so I doubt it.  Stuff like SOCKS4 or
SOCKS5 TCP proxies.

Find what is actually listening on the TCP socket server-side, it might
not be sshd (interposers like systemd socket activation, xinetd/inetd,
etc).  The logs/access control you need to look at server-side might not
be SSHD's in that case.

If it is sshd, ensure it is actually logging all you need, and carefully
study the logs.

If nothing helps, packet-dump both sides (client and server) and find
out what sent the TCP RST, as that might give you clues for the "why".
A middlebox might be doing it...

But get the remote admin to re-check server-side /etc/hosts.allow and
deny, sshd_config, etc. with an eye on "what might my SSH client be
using when it failed, and what it might have been using when it worked"
before all that debugging work.  Don't forget to consider IPv6, or all
possibly outgoing ranges of IPv4 NAT, if any.  It might pay off :-)

-- 
  Henrique Holschuh

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

OpenSSH: cause of random kex_exchange_identification errors? Vincent Lefevre <vincent@vinc17.net> - 2022-02-02 15:50 +0100
  Re: OpenSSH: cause of random kex_exchange_identification errors? Hans <hans.ullrich@loop.de> - 2022-02-02 16:20 +0100
    Re: OpenSSH: cause of random kex_exchange_identification errors? Vincent Lefevre <vincent@vinc17.net> - 2022-02-02 16:30 +0100
  Re: OpenSSH: cause of random kex_exchange_identification errors? Bijan Soleymani <bijan@psq.com> - 2022-02-02 17:50 +0100
  Re: OpenSSH: cause of random kex_exchange_identification errors? David Wright <deblis@lionunicorn.co.uk> - 2022-02-02 18:00 +0100
  Re: OpenSSH: cause of random kex_exchange_identification errors? gene heskett <gheskett@shentel.net> - 2022-02-02 20:30 +0100
    Re: OpenSSH: cause of random kex_exchange_identification errors? Greg Wooledge <greg@wooledge.org> - 2022-02-02 20:30 +0100
      Reusing ssh keys on a new installation, was Re: OpenSSH: cause of  random kex_exchange_identification errors? David Wright <deblis@lionunicorn.co.uk> - 2022-02-02 22:00 +0100
    Re: OpenSSH: cause of random kex_exchange_identification errors? Vincent Lefevre <vincent@vinc17.net> - 2022-02-03 04:20 +0100
  Re: OpenSSH: cause of random kex_exchange_identification errors? Henrique de Moraes Holschuh <hmh@debian.org> - 2022-02-05 22:40 +0100
    Re: OpenSSH: cause of random kex_exchange_identification errors? Vincent Lefevre <vincent@vinc17.net> - 2022-02-08 11:20 +0100
    Re: OpenSSH: cause of random kex_exchange_identification errors? Vincent Lefevre <vincent@vinc17.net> - 2022-06-07 18:00 +0200
      Re: OpenSSH: cause of random kex_exchange_identification errors? Tim Woodall <debianuser@woodall.me.uk> - 2022-06-07 18:20 +0200
        Re: OpenSSH: cause of random kex_exchange_identification errors? Vincent Lefevre <vincent@vinc17.net> - 2022-06-14 13:00 +0200
          Re: OpenSSH: cause of random kex_exchange_identification errors? Tim Woodall <debianuser@woodall.me.uk> - 2022-06-14 20:20 +0200
            Re: OpenSSH: cause of random kex_exchange_identification errors? Vincent Lefevre <vincent@vinc17.net> - 2022-06-15 03:50 +0200
              Re: OpenSSH: cause of random kex_exchange_identification errors? Vincent Lefevre <vincent@vinc17.net> - 2022-06-15 15:20 +0200
                Re: OpenSSH: cause of random kex_exchange_identification errors? Vincent Lefevre <vincent@vinc17.net> - 2022-06-15 16:00 +0200

csiph-web