Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

One of my ec2 servers has stopped receiving ssh connections. The OS is Ubuntu server 8.04, and the ssh server is the standard openssh-server.

After months of uptime, I tried to connet to it today, and got the following message:

ssh_exchange_identification: Connection closed by remote host

Any idea what could have went wrong?

Update: After a reboot, the server started receiving new connections. Disks are below 50% usage.

share|improve this question
    
First thing to do when you see this: try again with ssh -vvv, and look carefully through the output (or post it all for someone else to analyse; your password won't appear, but IP addresses and user names will). –  Gilles Aug 25 '11 at 23:46

5 Answers 5

up vote 3 down vote accepted

Now that you once again have access, check the log to determine what, if any, clues there are as to why you were blocked.

tail -n300 /var/log/auth.log | grep ssh 1

The other thing to remember is that, if it happens again, you can run ssh in verbose mode with the -vvv option, which will return more detailed diagnostic information. From man ssh:

-v    Verbose mode. Causes ssh to print debugging messages about its progress. This is helpful in debugging connection, authentication, and configuration problems. Multiple -v options increase the verbosity. The maximum is 3.



[1] You may need to increase/decrease the amount you tail by (-n) to identify the relevant entries.

share|improve this answer

This is a normal situation if multiple clients try to authenticate in the same time. This is configured by the MaxStartups option in /etc/ssh/sshd_config.

If MaxStartups=3, and 4 clients try to connect, the last client will display your message, it is rejected by the server because of too many authentications pending on the server side.

sshd behaves like this to prevent bruteforce attack.

share|improve this answer

Are you using some sort of automatic blocking? I have denyhosts isntalled, which will block the IP address after several failed login attempts, and I have locked myself out like this a few times.

share|improve this answer

It could be caused by time skew. Make sure that all machines are getting time from an internet time server.

share|improve this answer

Unlikely is a failed automatic package update.

Likely is a hardware failure, software failure (kernel resources leak), temporary routing failure, or hacking attempt gone awry.

I'm assuming a local managed user database for EC2.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.