Updated sshd journal on both jumphost and jumptarget

Full logs are too long to be pasted. uploaded to gist

three files are logs that :

Local -> Jumpper -> Debian by ssh -j

Local -> Jumpper -> Debian by ssh Debian

Local -> Jumpper by ssh jumpper

Jumper -> Debian by ssh

FYI: During this time, the IP address was re-planned ->, and a domain was added in the hosts. These shouldn't have any effect on the problem.

A similar problem is SSH ProxyJump on macOS Catalina is not working. but the answer doesn't solve my case

I'm configuring ssh jump with the following configures:

Host Jumper
    HostName domainName
    User username
    Port 1234

Host Debian
    User username
    Port 22
    ProxyJump Jumper

The result of ssh Debian -vvv is

debug1: kex_exchange_identification: banner line 0: \033(B\033[mSSH-2.0-OpenSSH_9.2p1 Debian-2
kex_exchange_identification: banner line contains invalid characters

it shows OpenSSH, so I think the port should be correct

ssh Jumper is fine, and manully ssh on jumper is also fine.

  • 1
    I have found similar(?) questions: ssh jump host option for some reason does not work, SSH ProxyJump on macOS Catalina is not working. I don't know how similar each one is to yours because you posted only a tiny fragment of the verbose output (please edit if you want to improve). The latter question is answered, the answer is upvoted, but probably it won't help you (and frankly I have no idea how the bug the answer talks about could cause problems with the banner). Sep 19 at 4:00
  • What are the versions of OpenSSH on all three machines? Sep 19 at 19:21
  • @KamilMaciorowski The latter one is exactly my problem here, and truly not solving.
    – Leo
    Sep 21 at 14:59
  • @user4556274 local host is a Macos at OpenSSH_9.0p1. Others are OpenSSH_9.2p2
    – Leo
    Sep 21 at 15:01
  • Please edit the question and add this relevant information there. The point is we (including you, I bet) want potential answerers to easily get the whole picture from the question alone, without any need to patch the question by seeking information in comments. Help them help you. Sep 21 at 15:12

1 Answer 1



At the first glance, I've been misslead by the keyword "banner" and the ANSI sequence. I do not delete but update this answer to preserve the helpful comments below.
Please regard this answer as a comment.

As roaima pointed out the Banner defined in sshd_config gets displayed at the beginning of the authentication, but your debug message is a result of kex-exchange that is done just before auth.

Also check Kamil Maciorowski, linked hint. — The tested string is part of the compiled code.

To find out more please activate at least debug level 1 by changing the /etc/ssh/sshd_config:

LogLevel DEBUG1
  • Restart your sshd by systemctl restart sshd
  • Note that at Debian any settings in /etc/ssh/sshd_config.d/*.conf will take precedence over those in /etc/ssh/sshd_config (the first match takes control).

Of interest are these entries and their neighbours:

File: /var/log/auth.log

Sep 17 01:03:43 lamp sshd[1861]: Connection from port 43854 on port 22 rdomain ""
Sep 17 01:03:43 lamp sshd[1861]: debug1: Local version string SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u1
Sep 17 01:03:43 lamp sshd[1861]: debug1: Remote protocol version 2.0, remote software version OpenSSH_9.2p1 Debian-2
Sep 17 01:03:43 lamp sshd[1861]: debug1: match: OpenSSH_9.2p1 Debian-2 pat OpenSSH* compat 0x04000000
  • Please do retrieve this at the JumpHost and the Destination Host (Debian) for the same connection attempt and update your question by the log results.
  • Also add the related output of localhost using ssh Debian -vvv (more than just the error to see the context)
  • It might be useful to also add the log of a ssh to the JumpHost itself, if there's a difference.
  • Same optional interest to the ssh connection JumpHost > Destination Host

Awaiting the results ...

Regarding the above, the point that the match for OpenSSH* is searched the relevance of some preceding "ANSI escape codes with typos" reduces to "some garbage that must not be there".

Your banner line contains a typo: Should be [ in \033(B, but not not (.

# Your line:
\033(B\033[mSSH-2.0-OpenSSH_9.2p1 Debian-2

# Fixed line:
\033[B\033[mSSH-2.0-OpenSSH_9.2p1 Debian-2

\033[B    # tells "Move Cursor down" 
\033[m    # reset the ANSI colors

Part of the original answer, but most likely not the solution for the question (see above):

Configure the banner of OpenSSH Server

The file is configured in /etc/ssh/sshd_config or /etc/ssh/sshd_config.d/*.conf:

Banner FileName

Did you find such an entry and the configured file?

Disable the banner by Banner none (and restart the sshd).

This has to be checked at both involved sshd: the JumpHost and the destination.

  • How does the banner get printed before the protocol identification string?
    – roaima
    Sep 18 at 22:46
  • should it be edited at localhost or Jumper or Debian ?; I have tried disable it on Jumper and Debian, but the output does not change.
    – Leo
    Sep 18 at 23:36
  • @Leo I think this answer is wrong. These are two different banners. Banner defines a custom banner while the problematic banner is the one that carries the version of SSH on the server. AFAIK the admin of the server cannot easily modify it. DebianBanner no is what the admin can do but I don't expect this to solve your problem either. Sep 19 at 3:44
  • @roaima : You are right, I've been misslead by the keyword "banner" and the ANSI sequence. Updated the answer.
    – dodrg
    Sep 19 at 18:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .