RE: ssh_exchange_identification error...

From: Arthur Boos Jr (boos@if.ufrgs.br)
Date: 12/05/02

  • Next message: Bill Schwalbe: "Re: ssh_exchange_identification error" 
    From: Arthur Boos Jr <boos@if.ufrgs.br>
To: secureshell@securityfocus.com
Date: Thu, 5 Dec 2002 08:43:37 -0200 (EDT)

    Tom Syroid writes:
    >
    > OK, I'm stumped. I've worked with SSH for a lot of years, but I can't seem
    > to get by this one.
    >
    > I'm responsible for administering a remote system 3,000 miles distant. No
    > one at the office is the least bit "computer-wise". The system is a Dell
    > PE4600 running RH 8.0. The only open port to the box is 22; on the other
    > end is OpenSSH 3.51-p1.
    >
    > Friday everything was working swell. I logged in, did some maintenance
    > stuff, logged out -- all without error or incident.
    >
    > This week when I try to log into the system, the command hangs for about
    > five minutes (ssh <hostname>) then returns:
    >
    > ssh_exchange_identification: Connection closed by remote host
    >
    > I've tried from several different boxes; same result each time.
    >
    > I've had someone restart the daemon on the remote system (/etc/init.d/sshd
    > restart). The task completed without error.
    >
    > Still no joy.
    >
    > WTF folks?? I've never seen this error message before. What direction
    > should I be heading off in? I can't get into the box to check error logs, I
    > can't get into the box to do anything. I've thought about asking someone to
    > power cycle the system, but if restarting the daemon didn't fix the
    > problem, am I gaining anything with a reboot?
    >
    > Any thoughts or ideas much appreciated.
    >

    Tom,

            Your connection probably is being refused *before* the authentication
    step. Are you using tcpwrapper or any firewall on remote host ? Perhaps the rules
    were changed and are rejecting connections from your host. If you are using
    identd (RFC931) in tcpwrapper rules and the firewall is rejecting connections
    to port 113, you will get the same kind of error.

            Best regards,

    Arthur 

    -- 
.____________________________________________________________________________.
| Universidade Federal do Rio Grande do Sul | Arthur Boos Jr                  |
| Instituto de Fisica                       | Setor de Informatica            |
| Av. Bento Goncalves, 9500, Agronomia      | Phone: (51) 3316-6550/3316-6559 |
| CEP 95501-970  Porto Alegre/RS  Brasil    | FAX:   (51) 3316-7286           |
`-------------------------------------------| E-Mail: boos@if.ufrgs.br        |
                                            `---------------------------------'
    Loading