2

I'm having trouble connecting to desktop1 (see figure below) from server (red arrow in figure) with ssh. It always says:

ssh_exchange_identification: Connection closed by remote host

I don't have problem connecting to the server from desktop1 or desktop2, nor do I have any problem connecting to desktop2 from server, or connecting from desktop1 to desktop2 and vice versa.

ssh connection problem between server and desktop1

I tried to troubleshoot the problem by creating a temporary sshd server on desktop1 as follows:

[desktop1]# $(which sshd) -Ddddp 4000

and to connect to it from server:

[server]# ssh -v -p 4000 root@desktop1
OpenSSH_7.1p2, OpenSSL 1.0.2g-fips  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 4000 desktop1
debug1: permanently_set_uid: 0/0
debug1: permanently_drop_suid: 0
debug1: identity file /root/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type 2
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.1
ssh_exchange_identification: Connection closed by remote host
#

which does not work.

But from desktop2, the connection works fine:

[desktop2]# ssh -v -p 4000 root@desktop1
OpenSSH_7.1p2, OpenSSL 1.0.2g-fips  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 4000 desktop1
debug1: permanently_set_uid: 0/0
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client chacha20-poly1305@openssh.com <implicit> none
debug1: kex: client->server chacha20-poly1305@openssh.com <implicit> none
debug1: kex: curve25519-sha256@libssh.org need=64 dh_need=64
debug1: kex: curve25519-sha256@libssh.org need=64 dh_need=64
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
[...]
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
Last login: Mon Mar  7 15:24:05 2016 from 10.0.21.200
Environment:
  LANG=en_US.UTF-8
  USER=root
  LOGNAME=root
  HOME=/root
  PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
  MAIL=/var/mail/root
  SHELL=/bin/bash
  SSH_CLIENT=10.0.21.200 39150 4000
  SSH_CONNECTION=10.0.21.200 39150 10.0.21.204 4000
  SSH_TTY=/dev/pts/1
  TERM=xterm-256color
  DISPLAY=localhost:11.0
Running /usr/bin/xauth remove unix:11.0
/usr/bin/xauth add unix:11.0 MIT-MAGIC-COOKIE-1 2843404fd74f1294efce8c6bb786fd75

File /etc/ssh/sshd_config is the same on desktop1 and desktop2.

The public/private keys of root are the same on server, desktop1 and desktop2.

Permissions are OK on all 3 machines and look like this:

# ll .ssh/
total 24
-rw-------  1 root root 1883 Nov  6 09:33 authorized_keys
-rw-------. 1 root root  668 Jan 26  2015 id_dsa
-rw-r--r--. 1 root root  620 Jan 26  2015 id_dsa.pub
-rw-------. 1 root root  887 Jan 26  2015 id_rsa
-rw-r--r--. 1 root root  240 Jan 26  2015 id_rsa.pub
-rw-r--r--. 1 root root 1893 Nov  5 10:31 known_hosts

Traceroute finds both desktops from server:

[server]# traceroute -T -p 22 desktop1
traceroute to desktop1 (10.0.21.204), 30 hops max, 60 byte packets
 1  gateway (10.0.21.30)  0.704 ms  0.874 ms  1.041 ms
 2  desktop1 (10.0.21.204)  0.325 ms  0.438 ms  0.407 m
[server]#
[server]# traceroute -T -p 22 desktop1
traceroute to desktop2 (10.0.21.200), 30 hops max, 60 byte packets
 1  gateway (10.0.21.30)  0.847 ms  0.985 ms  1.158 ms
 2  desktop2 (10.0.21.200)  0.286 ms  0.310 ms  0.314 ms

So, what can be the cause of this ID exchange problem: ssh_exchange_identification: Connection closed by remote host ?

Thank you for your help.

Regards, Fuji.

  • What do you have on desktop1 int /etc/hosts.allow and /etc/hosts.deny? What can you get from logs on the server? – Jakuje Mar 7 '16 at 15:11
  • I have nothing (only commented lines). – Fuji San Mar 7 '16 at 15:14
  • What Linux distribution are you using? What openssh version do you have what kernel version do you run? We had similar issue with recent (4.4.2+) kernel in Fedora. – Jakuje Mar 7 '16 at 15:17
  • I have Fedora 23 and openssh-7.1p2-4.fc23.x86_64 on all 3 machines . desktop1 is 4.4.2-301.fc23.x86_64 ans server is 4.2.6-301.fc23.x86_64. – Fuji San Mar 7 '16 at 15:20
  • Do you have iptables enabled on Desktop1 ? if yes, is it allowing ssh from the server's network ? – MelBurslan Mar 7 '16 at 15:21
2

This is known issue (probably in kernel), tracked as rhbz#1313979

Booting older kernel (ex. kernel 4.3.5-300.fc23.x86_64) should resolve the issue (as a workaround). More investigation is welcomed here or in the bugzilla.

3

Your problem can be caused by :

debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 4000 desktop1

Edit /etc/ssh/ssh_config and comment ProxyCommand line. I've encountered this when joining clients to FreeIPA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.