ssh_exchange_identification: connection closed by remote host Ubuntu.

Are you stuck with this error while connecting to Ubuntu servers using SSH?

The error occurs due to bad configuration of the SSH daemon or server-side restrictions.

At Bobcares, we often get requests to fix ssh errors, as a part of our Server Management Services.

Today, let’s see how our Support Engineers fix this error.

 

Why does ssh_exchange_identification fail?

The SSH protocol is a method for secure remote connection between machines.

Recently one of our customers was trying to SSH into a server, but it returned the error,

ssh_exchange_identification: Connection closed by remote host

This error indicates that the remote host closed the connection suddenly. This is a common error that users get when they try to connect to SSH servers.

The main reason for this error can be related to the hosts.deny and hosts.allow configuration files.

 

How we fix ssh_exchange_identification: connection closed by the remote host?

Since this denies the SSH connection, troubleshooting requires SSH access from at least from a valid IP address. Or we’ll have to use the console access of the server.

Now let’s see how our Support Engineers fix this error when our customers are locked out of the server.

 

1. Check hosts.deny and hosts.allow files

The main reason for this error is the configuration in the hosts.deny and hosts.allow files. So we check the /etc/hosts.allow and /etc/hosts.deny files. These files contain the allowed or denied hosts on the system.

1. Initially, we open the hosts.deny file using this command.

vi /etc/hosts.deny

Here we check the sshd field in the hosts.deny file. If it is ALL, it means it denies connections from all hosts. We always add this line only after ensuring that the hosts.allow file has our IP address. If the customer’s IP is in the deny list, we remove the line and save the file.

2. Next, we open the hosts.allow file.

vi /etc/hosts.allow

Then we add the field sshd: ALL in it. Or to restrict to a particular IP address range, we add the entry as

sshd : xxx.xxx.xxx.*

Finally, save it.

 

2. Add missing dependencies

If the ssh error shows after updating OpenSSL or glibc, then it might be due to missing dependencies. So we check if the ssh daemon had deleted any files. To check this we use the command,

lsof -n | grep ssh | grep DEL

If we did not get anything back then we restart the system. And to add dependencies we update ssh.

 

3. Check for memory fragmentation

Another reason for this error is memory fragmentation on the host side. If the host does not have swap partitions it can lead to memory fragmentation. We check the memory usage status of the services using,

vmstat -s

Then we restart the service like MySQL, Apache, Nginx, etc, that are having memory problems.

 

4. Additional ssh instances

Here, we check the maximum number of ssh connections. We check the user processes logged in using the command,

who

If we see many parallel users logged in at a time, we kill the user processes and try to connect again.

 

5. The sshd connection limit

If the maximum number of ssh connections is so small, it may cause this ssh error. So we check the default ssh connection and try to increase the MaxStartups value. We check this using the command,

In most cases, the system should have default 10 simultaneous connections, which should be plenty for most servers.

 

6. ssh fingerprint/keys

The other reason for this error is corrupted fingerprints or keys. So, we remove the server-side fingerprints from the clients ~/.ssh/known_hosts and try to connect. If this succeeds, we change the key.

 

7. Heavy server load

If a high server load is rejecting the ssh connection, we check the process causing the load. If it is any kind of attack, we take measures to stop it. Thus, it helps to regain SSH access.

 

[Still, having trouble in fixing SSH errors? We’ll fix it for you.]

 

Conclusion

In short, the error ssh_exchange_identification: connection closed by the remote host in Ubuntu happens due to incorrect SSH configuration or server restrictions. Today, we saw how our Support Engineers fixed this error.