0

I wanted to allow SSH TCP forwarding for a specific user, so I added this section to sshd_config:

Match User rainmannoodles
    AllowTcpForwarding yes
    TCPKeepAlive yes

After that change, I get the following message when connecting:

ssh_exchange_identification: Connection closed by remote host

If I comment out the Match User block, everything works fine. That block is the last one in the file.

I can't think of any reason for this behavior. What exactly is going on here? Here's the full -vvv output:

OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to localhost [::1] port 22.
debug1: Connection established.
debug1: identity file /Users/rainmannoodles/.ssh/id_rsa type -1
debug1: identity file /Users/rainmannoodles/.ssh/id_rsa-cert type -1
debug1: identity file /Users/rainmannoodles/.ssh/id_dsa type -1
debug1: identity file /Users/rainmannoodles/.ssh/id_dsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
ssh_exchange_identification: Connection closed by remote host
Improve this question
1

1 Answer 1

Reset to default
1

Check the logs on the server to see what's going wrong.

I expect sshd is complaining that your configuration file is ill-formed. The option TCPKeepAlive cannot be used in a Match block, presumably because sshd doesn't support changing the value of the option once authentication has finished (this option is used from the start of the connection, before Match conditions can be tested).

Improve this answer
1
  • Thanks, that was the problematic option, and I confirmed it in the logs. (On that note, I really wish there was an easy, universal way to just print log (and config, and data) file locations for a given program. Switching distros... ugh...) I also found sshd -t which checks the config file for errors before the problems actually take effect, so I'm going to start using that every time I do anything on a remote machine. :)
    – Rainman Noodles
    Jul 14, 2015 at 13:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .