Error: ssh_exchange_identification: Connection closed by remote host

Posted on Updated on

When using SSH this error may show it’s ugly head on occasion. Many searches for the issues point to funny TCP connection tweaks or that sshd needs to be re-configured. This is not the case.

Error :

[root@server ]# ssh -v 222.333.444.555
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 222.333.444.555 [222.333.444.555] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1
ssh_exchange_identification: Connection closed by remote host

This can be caused by a number of issues, steps to test are as follows.

Check /etc/hosts.deny and /etc/hosts.allow

Many have reported configuring these to values properly has helped. However, we’ve seen this issue even when hosts.* files were not a factor.

[root@server]# grep sshd /etc/hosts.allow
sshd: ALL

Missing Dependencies

This one typically happens after a glibc or openssl upgrade. Many distros can install updates to glibc or openssl libs and not require a restart to sshd.

On any distro you can recognize it when after an update, then use lsof to see where sshd has open files. Some will be pointed to DEL, because those libs were deleted on update.

[root@server]#lsof -n | grep ssh | grep DEL

When an SSH connection comes in the sshd daemon forks and attempts to attach (ld) these lib files, and fails resulting in this error.

Corrupted Fingerprint / Keys

Some how one or the other of the fingerprints or keys has become corrupted (did you manually edit one of these files?). Remove the server-side fingerprint in the clients ~/.ssh/known_hosts and try again. When you re-connect you will be prompted to accept the host identity again.

If you are able to access the machine another way you may want to back-out and re-create the server-side ~/.ssh/authorized_keys.

Along the same lines as this issue, if the files /etc/ssh/*key* are removed and sshd is not restarted then this error will show up too. Check for the key files in the sshd configuration directory.

Heavy Server Load

Have also seen this happen when server was under heavy load from for example, brute force attack. Increase the amount of connections sshd can run.

[root@server ] grep MaxStartups /etc/ssh/sshd_config
# Old Style
MaxStartups 12
# New Style
MaxStartups 10:20:30

One thought on “Error: ssh_exchange_identification: Connection closed by remote host

    Bryan Hoffpauir said:
    July 27, 2013 at 2:03 am

    I’ve most commonly found that I get this error when my IP address gets added to a DenyHosts blacklist. You’ll have to get denyhosts reconfigured to allow access from your IP should this happen. You may find to be helpful in that case.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s