Too many authentication failures from ssh

MS1 · 2024-01-27 15:59:25

I have been experiencing times where ssh stops allowing me to connect giving this:

$ ssh 192.168.1.1
Received disconnect from 192.168.1.1 port 22:2: Too many authentication failures
Disconnected from 192.168.1.1 port 22

The "fix" is to run:

kill $(pidof ssh-agent)

So it can be worked-around but I want to know why it is happening in the first place.

Tula-gingerbread · 2024-01-27 16:50:14

You can try setting "MaxAuthTries" in /etc/ssh/sshd_config to a higher value.
P.S. Has your system been updated?

seth · 2024-01-28 11:42:53

Is this systematic ("everytime I login I have to kill ssh-agent to be able to use ssh") or occasional ("happens on fridays or when it's raining, not sure")?
Did you check the server logs for the auth failures?
Does the server face the interwebz or is it strictly LAN?

MS1 · 2024-01-28 13:32:34

It is occasional and could be related to an update of some packages but I have not found that link. When I check the journalctl output on the machine I tried to connect to all I see is:

sshd[13426]: Received disconnect from 192.168.1.102 port 34042:11: disconnected by user
sshd[13426]: Disconnected from user mike 192.168.1.102 port 34042
sshd[13426]: pam_unix(sshd:session): session closed for user mike

The server is only LAN facing.

graysky · 2024-01-28 14:28:45

I've experienced the same maybe 3-4 times over the past few months. Attempted connections out to many hosts on my LAN or to hosts over the the WAN (remote servers) gave the same behavior/error message shown by the OP. Since it was multiple systems, I assumed the problem was on workstation and googling found the work-around posted above (simply kill ssh-agent which will restart when you try to connect out). It's annoying but easily fixed. I too am baffled as to root cause.

Last edited by graysky (2024-01-28 14:29:51)

seth · 2024-01-28 16:08:56

https://wiki.archlinux.org/title/OpenSSH#Checklist
Raise the debug level, check when and how the authentication failures occur and correlate that w/ client actions.

How do you invoke ssh-agent?
https://wiki.archlinux.org/title/SSH_ke … stemd_user ?

graysky · 2024-01-28 21:58:15

You asking me, Seth or the OP? For me, ssh-agent is getting pulled in by login to sddm/xfce4. I am doing nothing special. Believe it or not, I do not run sshd on my workstation. No need for incoming connections to raising the log level would have no effect. I can do it on one of the target boxes ovbiously.

seth · 2024-01-28 22:05:55

Everyone interested

I can do it on one of the target boxes ovbiously.

That would have been the plan, to see whether and when your IP has failed to authenticate with the server leading up to this.

You're most likely using the user service then

systemctl --user status ssh-agent.service

graysky · 2024-01-29 12:22:41

For user agents with ssh in their title, I just seems to have:

gcr-ssh-agent.socket
gpg-agent-ssh.socket

seth · 2024-01-30 13:53:12

What's either status? Are you using gnome keyring?
gpg-agent and ssh-agent are alternatives, the latter one is typically started on one of these ways but idk about GKR

matty_r · 2024-03-10 19:40:48

If anyone else comes across this, I needed to disable gcr-ssh-agent service/socket:

systemctl --user disable gcr-ssh-agent
systemctl --user disable gcr-ssh-agent.socket
sudo systemctl --global disable gcr-ssh-agent.socket

Arch Linux

#1 2024-01-27 15:59:25

Too many authentication failures from ssh

#2 2024-01-27 16:50:14

Re: Too many authentication failures from ssh

#3 2024-01-28 11:42:53

Re: Too many authentication failures from ssh

#4 2024-01-28 13:32:34

Re: Too many authentication failures from ssh

#5 2024-01-28 14:28:45

Re: Too many authentication failures from ssh

#6 2024-01-28 16:08:56

Re: Too many authentication failures from ssh

#7 2024-01-28 21:58:15

Re: Too many authentication failures from ssh

#8 2024-01-28 22:05:55

Re: Too many authentication failures from ssh

#9 2024-01-29 12:22:41

Re: Too many authentication failures from ssh

#10 2024-01-30 13:53:12

Re: Too many authentication failures from ssh

#11 2024-03-10 19:40:48

Re: Too many authentication failures from ssh

Board footer