Category: Linux

When i ssh into a server, i get following error

root@lab:~# ssh [email protected] -p 3333
Received disconnect from 14.18.58.78: 2: Too many authentication failures
root@lab:~#

I checked server log (/var/log/auth.log) and found following

Nov 13 19:06:42 lab sshd[32030]: error: maximum authentication attempts exceeded for root from 188.40.131.92 port 52956 ssh2 [preauth]
Nov 13 19:06:42 lab sshd[32030]: Disconnecting: Too many authentication failures [preauth]

This error happens when you have several SSH keys. When you try to connect to remote server, ssh client try to autenticate to remote server using SSH keys present on your computer. If you have several keys, ssh client make that much login attempts if the keys are valid for remote server you are trying to login.

ssh server deamon have a settings MaxAuthTries. Default value for this settings is 6. If number of invalid login attempt exceeds the value of MaxAuthTries, you will get above error.

You can see all SSH keys on your computer with

ssh-add -l

If you have many keys, consider removing some of the keys from agent using ssh-add command.

To fix this error edit file

vi /etc/ssh/sshd_config

Check if the file have entry for MaxAuthTries, if yes, increase its value. If no entry present in the server add it.

MaxAuthTries 8

Restart sshd service.

systemctl restart sshd

You can see how many login attemts you make using ssh -v option (verbose).

root@server12:~# ssh -v [email protected] -p 3333
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /root/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 174.138.58.78 [174.138.58.78] port 3333.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/identity-cert type -1
debug1: identity file /root/.ssh/id_rsa type 1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.8
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.8 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-sha1 none
debug1: kex: client->server aes128-ctr hmac-sha1 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<2048<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '[174.138.58.78]:3333' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:139
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: /home/boby/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: boby@hon-pc-01
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: redbridgefinance-mumbai
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: aws-eb
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: aws-austin-boby
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /root/.ssh/identity
debug1: Offering public key: /root/.ssh/id_rsa
Received disconnect from 174.138.58.78: 2: Too many authentication failures
root@server12:~# 

See SSH

If you have a server with SSH access, you can use it as sock 5 proxy or for port forwarding with just ssh access.

Socks5 Proxy

SSH tunnel can be used for browsing security. It act like a socks5 proxy.

ssh root@SERVER_IP -D 7373

OR

ssh -f -N root@REMOTE_SERVER_IP -D 7373

SERVER_IP is IP of the remote server, that you will be using as sock 5 server.

You can configure your browser to use sock5 proxy with IP address 127.0.0.1 and port 7373. You can change port by changing port in above commands.

-N = Do not execute a remote command. This is useful for just forwarding ports.
-f = go into background mode.

Forwarding Remote Port to local

You have a remote server that run a service on some port, that is not accessable to public. This is useful for services like MySQL, redis that is bind to 127.0.0.1 by default for security reason.

ssh -L 9999:127.0.0.1:3306 root@REMOTE_SERVER_IP

Example

ssh -L 9999:127.0.0.1:3306 [email protected]

MYSQL running on remote server will be available on port 9999 on local computer.

You can add -f -N option in cause you need above ssh command run in background.

Forwarding local port to remote server

Lets say you have a local web site running on your computer, you need to show this to your customer. You can’t make the web site from your computer as you are behind NAT network and your router don’t support port forwarding.

To forward local port to remote server, run

ssh -R REMOTE_PORT:localhost:LOCAL_PORT root@REMOTE_SERVER_IP

Example

ssh -R 8080:localhost:80 [email protected]

Service running on port 80 on local computer will be available on remote server on port 8080. Your customer can view the web site using url REMOTE_SERVER_IP:8080

See SSH, SSH Port Forwarding