50

We have a Windows batch script, which connects automatically to a linux server via PLINK (putty). There is NO public private key authentication, the user and the password are in the script.

On our linux server we have several sshd log entries (/var/log/messages):

sshd[7645]: Connection closed by xxx [preauth]

What could be the cause for such a message?
"preauth" supposably means "pre authentication"?

Sometimes in the entry, "closed by" has the ip address of the windows client, another time there is the ip address of the linux server in "closed by". Does anybody know the differency betweend client ip address and host ip address in the message?

  • When observed in /usr/local/sbin/sshd -D -e, possible workaround: serverfault.com/a/211176 – Ivan Chau Oct 2 '16 at 16:40
  • I am experiencing the same problem and in my case i have narrowed it down to the fact that the same key works from a ubuntu shell on an real ubuntu running as an VM and not from the ubuntu embedded into Windows 10 (AKA Windows Linux Subsystem). Haven't figured out why yet, but maybe this still helps someone – Jens Kisters Jan 23 '17 at 7:20
22

The sshd server will disconnect if the client doesn't try to authenticate in a certain period of time, as documented in the -g option.

 -g login_grace_time
         Gives the grace time for clients to authenticate themselves
         (default 120 seconds).  If the client fails to authenticate
         the user within this many seconds, the server disconnects
         and exits.  A value of zero indicates no limit.

So I suspect if you see the server IP in the logs with this message, the connection was closed because no authentication attempt occurred within this grace time. When you see the client IP, it means the user closed their client (or the script terminated) without making an authentication attempt.

  • Can it be caused by e.g nmap scanning? – Qback Mar 14 '18 at 16:58
  • This is usually hack attempts. I see a lot from China, Russia, Japan, etc. – jjxtra Jul 3 '18 at 16:52
  • 3
    If the IP address in the message is the client's IP address it may indicate that the client is attempting to authenticate with the incorrect passphrase for their private key. Their client then fails to decode the key and disconnects without attempting authentication. – Code Commander Aug 20 '18 at 23:26
7

In my case, these messages appeared in /var/log/secure when I was experiencing Host key verification failed. errors on the ssh client side. This is one of the cases that would result in a connection without a login attempt.

4

I had a very similar problem to yours (though I was using public key).

It turns out my problem, and possibly yours, was caused because my home directory was a NFS mount, and selinux (on CentOS 7) was throwing up some errors (which were quite hard to track down). The fix was simple though.

setsebool -P use_nfs_home_dirs 1 
2

Another source of these kind of messages is ssh-keyscan. It just grabs server host keys and disconnects without doing any authentication.

1

I had the same problem, I solved it like this:

On the ssh server, I uncommented, and put at yes the following values in /etc/ssh/sshd_config

 RSAAuthentication yes
 PubkeyAuthentication yes

And then:

sudo service sshd restart
1

One source of these messages is https://sshcheck.com/ which displays possible weakness on your ssh server.

It causes about 4 of these messages sequentially.

0

I met the same situation, because of the iptables INPUT rule was DROP, but ACCEPT the ansible host, but there are not have the rule iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

The error log "Nov 3 01:34:50 debian sshd[29378]: Connection closed by 10.17.64.13 [preauth]" was wrote in "/var/log/auth.log" at the client machine after the command ansible all -m ping was ran in the ansible host.

Because the ping packet had receive by the client but not return to the ansible host.

protected by Community Jan 23 '17 at 11:30

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.