Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
Most of the time ssh [email protected] works fine, but sometimes I get this error message:
ssh_exchange_identification: Connection closed by remote host
The basic debugging step is to check the trace and the logs.
You get a trace of what SSH does by adding the -v option to the ssh command. Repeating the option gives you more logs. Most network- and authentication-related issues require -vv.
ssh -vv [email protected]
“Connection closed by remote host” is a somewhat generic message: it means that the remote host closed the connection at some point instead of sending a reply to a packet. The cause could be completely different depending on exactly when this happens. The trace will at least indicate the time, if not the cause.
There are more logs on the server side. These require administrator permissions to view (they may contain security-sensitive information). The logs are generally stored in /var/log, but this depends on the distribution, on the system configuration and on the choice of logging software.
Since this is an intermittent error, the most likely error is that some system component is running out of resources (memory, file descriptors, terminals, …). It could also be a network relay on the way that's dropping the connection, or that's dropping or corrupting packets. Depending on the cause, this may or may not risk affecting Apache as well.
auth.log. The easiest way to find the right log is to make an attempt and check which files in /var/log were modified during that attempt.
Jan 21, 2015 at 15:29
btmp records login sessions. If it changes, I think that means that you were successfully authenticated, then something happened. You won't find any clues as to why in that file though.
Jan 21, 2015 at 16:43