Connection closed by remote host

[boris brinza]

Hello,

I have strange problems with connecting to remote machine running suse
enterprise 9.0 sp3 using ssh

After server is restarted, everything works fine.
Then, after 5-6 days, sshd starts to drop incoming connections.
Server has IP from private network range, i connect to router with
public IP, port 222, which is then forwarded to my server (port 22)
Sometimes, ssh starts to work, but 10 minutes later, again, connections
are refused.

Here is log i've got at client side:

hts-fw:~# ssh xxx.xxx.xxx.xxx -p 222 -vvv
OpenSSH_4.3p2 Debian-9, OpenSSL 0.9.8c 05 Sep 2006
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
Connecting to xxx.xxx.xxx.xxx [xxx.xxx.xxx.xxx] port 222.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1
ssh_exchange_identification: Connection closed by remote host

Have anyone anything, that can help?
Tahnks in advance

Boris

--
HT Solution s.r.o.
Slávičie údolie 104
811 02 Bratislava
tel: [phone]
mob: [phone]
web: www.htsolution.sk

[Aslan Carlos-3]

Are you use Tcpd (Tcpwrapper)  restrictions? I got some cases with this
problem.

On Tue, 2008-05-06 at 13:27 +0200, boris brinza wrote:

> Hello,
>
> I have strange problems with connecting to remote machine running suse
> enterprise 9.0 sp3 using ssh
>
> After server is restarted, everything works fine.
> Then, after 5-6 days, sshd starts to drop incoming connections.
> Server has IP from private network range, i connect to router with
> public IP, port 222, which is then forwarded to my server (port 22)
> Sometimes, ssh starts to work, but 10 minutes later, again, connections
> are refused.
>
> Here is log i've got at client side:
>
> hts-fw:~# ssh xxx.xxx.xxx.xxx -p 222 -vvv
> OpenSSH_4.3p2 Debian-9, OpenSSL 0.9.8c 05 Sep 2006
> debug1: Reading configuration data /etc/ssh/ssh_config
> debug1: Applying options for *
> debug2: ssh_connect: needpriv 0
> Connecting to xxx.xxx.xxx.xxx [xxx.xxx.xxx.xxx] port 222.
> debug1: Connection established.
> debug1: permanently_set_uid: 0/0
> debug1: identity file /root/.ssh/identity type -1
> debug1: identity file /root/.ssh/id_rsa type -1
> debug1: identity file /root/.ssh/id_dsa type -1
> ssh_exchange_identification: Connection closed by remote host
>
> Have anyone anything, that can help?
> Tahnks in advance
>
> Boris
>

--

Aslan Carlos <aslan@...>

[Ross Del Duca]

It seems very likely that you may be hitting the maximum number of unauthenticated connections.  I believe the default is 10.  Anytime someone has connected, but has not yet fully authenticated, they are in this bucket.  This can really show up on publically available SSH daemons - perhaps your connections are getting chewed up by someone trying to brute-force your passwords.

Another possibility (sorry, can recall exact versions where this effected it) is a bug I ran into where connections that exited too quickly also resulted in a similar situation.   Look at the output of ps and see if you have a bunch of defunct SSH processes laying around.  I ran into this on some of our Debian Sarge hosts, where I was doing a simple ssh 'cat /proc/loadavg' for monitoring.  I didn't dig too much into it, but if you google around you should be able to find something there.  An upgrade got around this in our case.

On Tuesday, May 06, 2008, at 12:30PM, "boris brinza" <boris.brinza@...> wrote:

>Hello,
>
>I have strange problems with connecting to remote machine running suse
>enterprise 9.0 sp3 using ssh
>
>After server is restarted, everything works fine.
>Then, after 5-6 days, sshd starts to drop incoming connections.
>Server has IP from private network range, i connect to router with
>public IP, port 222, which is then forwarded to my server (port 22)
>Sometimes, ssh starts to work, but 10 minutes later, again, connections
>are refused.
>
>Here is log i've got at client side:
>
>hts-fw:~# ssh xxx.xxx.xxx.xxx -p 222 -vvv
>OpenSSH_4.3p2 Debian-9, OpenSSL 0.9.8c 05 Sep 2006
>debug1: Reading configuration data /etc/ssh/ssh_config
>debug1: Applying options for *
>debug2: ssh_connect: needpriv 0
>Connecting to xxx.xxx.xxx.xxx [xxx.xxx.xxx.xxx] port 222.
>debug1: Connection established.
>debug1: permanently_set_uid: 0/0
>debug1: identity file /root/.ssh/identity type -1
>debug1: identity file /root/.ssh/id_rsa type -1
>debug1: identity file /root/.ssh/id_dsa type -1
>ssh_exchange_identification: Connection closed by remote host
>
>Have anyone anything, that can help?
>Tahnks in advance
>
>Boris
>
>--
>HT Solution s.r.o.
>Slávi?ie údolie 104
>811 02 Bratislava
>tel: [phone]
>mob: [phone]
>web: www.htsolution.sk
>
>
>

[Sengor]

Nazdar Boris,

Try starting up sshd process in foreground and verbose debug mode on
another port (at the server end, not on port 22). Then from the client
ssh into the server's IP/New-Port and watch the server's sshd debug
messages, see if they reveal more info about what the connection was
doing @ the time of the disconnect...

> On Tuesday, May 06, 2008, at 12:30PM, "boris brinza" <boris.brinza@...> wrote:
>>Hello,
>>
>>I have strange problems with connecting to remote machine running suse
>>enterprise 9.0 sp3 using ssh
>>
>>After server is restarted, everything works fine.
>>Then, after 5-6 days, sshd starts to drop incoming connections.
>>Server has IP from private network range, i connect to router with
>>public IP, port 222, which is then forwarded to my server (port 22)
>>Sometimes, ssh starts to work, but 10 minutes later, again, connections
>>are refused.
>>
>>Here is log i've got at client side:
>>
>>hts-fw:~# ssh xxx.xxx.xxx.xxx -p 222 -vvv
>>OpenSSH_4.3p2 Debian-9, OpenSSL 0.9.8c 05 Sep 2006
>>debug1: Reading configuration data /etc/ssh/ssh_config
>>debug1: Applying options for *
>>debug2: ssh_connect: needpriv 0
>>Connecting to xxx.xxx.xxx.xxx [xxx.xxx.xxx.xxx] port 222.
>>debug1: Connection established.
>>debug1: permanently_set_uid: 0/0
>>debug1: identity file /root/.ssh/identity type -1
>>debug1: identity file /root/.ssh/id_rsa type -1
>>debug1: identity file /root/.ssh/id_dsa type -1
>>ssh_exchange_identification: Connection closed by remote host
>>
>>Have anyone anything, that can help?
>>Tahnks in advance
>>
>>Boris
>>
>>--
>>HT Solution s.r.o.
>>Slávi?ie údolie 104
>>811 02 Bratislava
>>tel: [phone]
>>mob: [phone]
>>web: www.htsolution.sk

--
_________________________________/ sengork.blogspot.com /¯¯¯¯