8

So I finally made the move in my office to Ubuntu! Overall, I am very happy with the move from Mac and Windows. Most issues I was able to fix (graphic card issues) but this one issue I seem to fix but it keeps coming back.

I am using Filezilla and I have a custom SSH config. I also noticed this happens on PHPStorm as well. I am assuming the fix for FileZilla will fix PHPStorm too.

My SSH config is:

# Catch all
Host *
 ServerAliveInterval 120
 ServerAliveCountMax 30
 IdentitiesOnly yes

# Local Dev VM
Host jpCentos devel jp
 HostName jpCentos
 User adminJeremy
 IdentityFile /home/jpsimkins/.ssh/jpCentos
 IdentitiesOnly yes

# Local Dev VM Root (added as work-a-round for filezilla)
Host jpCentosRoot jpRoot
 HostName jpCentos
 User root
 IdentityFile /home/jpsimkins/.ssh/jpCentosRoot
 IdentitiesOnly yes

# Kyle Dev VM
Host kkCentos kk
 HostName kkCentos
 User adminJeremy
 IdentityFile /home/jpsimkins/.ssh/jpCentos
 IdentitiesOnly yes

# Staging Server
Host stagingServer staging stage
 HostName 10.1.1.120
 User adminJeremy
 IdentityFile /home/jpsimkins/.ssh/StagingServer
 IdentitiesOnly yes

# OlympusatV2 PRODuction Server 
Host olympusatV2 v2 live prod
 HostName 166.78.xxx.xxx
 User adminJeremy
 IdentityFile /home/jpsimkins/.ssh/OlympusatV2
 IdentitiesOnly yes

# OlympusatV2 PRODuction Server Root User (added as work-a-round for filezilla)
Host olympusatV2Root v2Root v2root liveroot prodRoot prodroot
 HostName 166.78.xxx.xxx
 User root
 IdentityFile /home/jpsimkins/.ssh/OlympusatV2Root
 IdentitiesOnly yes

# ParablesServer
Host parablesServer ps
 HostName 162.242.xxx.xxx
 User adminJeremy
 IdentityFile /home/jpsimkins/.ssh/ParablesServer
 IdentitiesOnly yes

# ParablesServerRoot  (added as work-a-round for filezilla)
Host parablesServerRoot psRoot psroot ParablesServerRoot
 HostName 162.242.xxx.xxx
 User root
 IdentityFile /home/jpsimkins/.ssh/ParablesServerRoot
 IdentitiesOnly yes

The names HostName is mapped in my .hosts file. This makes it easier to update the IPs when I move between the offices. It should be noted, that even if I use the IP in place of the .hosts file alias the issue is the same.

My issue is, every time I try to SFTP to a server I get:

Command:    open "[email protected]" 22
Error:  Server sent disconnect message
Error:  type 2 (protocol error):
Error:  "Too many authentication failures for root"
Error:  Could not connect to server

Filezilla in Verbose:

Status: Connecting to 10.1.1.69...
Trace:  Going to execute /usr/bin/fzsftp
Response:   fzSftp started
Trace:  CSftpControlSocket::ConnectParseResponse(fzSftp started)
Trace:  CSftpControlSocket::SendNextCommand()
Trace:  CSftpControlSocket::ConnectSend()
Command:    open "[email protected]" 22
Trace:  Server version: SSH-2.0-OpenSSH_5.3
Trace:  Using SSH protocol version 2
Trace:  We claim version: SSH-2.0-PuTTY_Local:_Sep_14_2013_01:12:43
Trace:  Doing Diffie-Hellman group exchange
Trace:  Doing Diffie-Hellman key exchange with hash SHA-256
Trace:  Host key fingerprint is:
Trace:  ssh-rsa 2048 ae:7c:66:41:8d:5a:18:53:ea:ca:ac:0a:ce:27:cc:4d
Trace:  Initialised AES-256 SDCTR client->server encryption
Trace:  Initialised HMAC-SHA1 client->server MAC algorithm
Trace:  Initialised AES-256 SDCTR server->client encryption
Trace:  Initialised HMAC-SHA1 server->client MAC algorithm
Trace:  Pageant is running. Requesting keys.
Trace:  Pageant has 10 SSH-2 keys
Trace:  Trying Pageant key #0
Trace:  Server refused public key
Trace:  Trying Pageant key #1
Trace:  Server refused public key
Trace:  Trying Pageant key #2
Trace:  CSftpControlSocket::ResetOperation(66)
Trace:  CControlSocket::ResetOperation(66)
Error:  Could not connect to server
Status: Waiting to retry...
Status: Connecting to 10.1.1.69...
Trace:  Going to execute /usr/bin/fzsftp
Response:   fzSftp started
Trace:  CSftpControlSocket::ConnectParseResponse(fzSftp started)
Trace:  CSftpControlSocket::SendNextCommand()
Trace:  CSftpControlSocket::ConnectSend()
Command:    open "[email protected]" 22
Trace:  Server version: SSH-2.0-OpenSSH_5.3
Trace:  Using SSH protocol version 2
Trace:  We claim version: SSH-2.0-PuTTY_Local:_Sep_14_2013_01:12:43
Trace:  Doing Diffie-Hellman group exchange
Trace:  Doing Diffie-Hellman key exchange with hash SHA-256
Trace:  CSftpControlSocket::ResetOperation(66)
Trace:  CControlSocket::ResetOperation(66)
Error:  Could not connect to server

When I SSH through terminal I have no issues.

I read somewhere that running:

ssh-add -k ~/.ssh/KEYNAME

Would resolve the issue (I'm not 100% sure if this was the fix, I was trying a lot of different things last week) but it seems after I restarted my machine it started happening again. So naturally I tried to run the command again but no dice.

I'm new to this stuff but looking at the log it appears it's trying to use all the keys to authenticate although I am telling SSH to use IdentitiesOnly

I deleted ~/.putty as I have seen this suggested before but I still get he same errors (after accepting the fingerprint).

Any help, ideas, or suggestions are appreciated. I searched around the webs and couldn't find anything so if this is a dup, let me know.

Thanks

2
  • superuser.com/questions/187779/…
    – NGRhodes
    Dec 7, 2014 at 9:45
  • I appreciate your help but I already have their suggestion (IdentitiesOnly) in my config and the issue still persists. I make this clear at the bottom of my question. Thanks though
    – Jeremy
    Dec 8, 2014 at 15:16

4 Answers 4

8

BEWARE: FileZilla tries to connect using the keys in .ssh directory.

I had same trouble. After doing some analysis of FileZilla logs (debug logs can be enabled by setting the debug level = 3 in Edit > Preferences > Debug), I noticed that is was printing line filezilla Trying Pageant key # for each unsuccessful attempt to authenticate to server.

After 5 unsuccessful attempts it disconnects printing 'Too many authentication failure' error.

Solution: Move the keys to somewhere else.

FileZilla uses Pageant mechanism and tries to authenticate with the keys already stored in .ssh directory. I had some keys stored in the .ssh directory to connect to my local VMs. I simply moved all keys to a subdirectory in .ssh. I tried to connect again and then FileZilla working normally.

1
5

I have the same issue and found a better solution, than moving away keys.


Run filezilla with env variable SSH_AUTH_SOCK=null:

SSH_AUTH_SOCK=null filezilla &

For permanent solution, change the .desktop file Exec= line to env SSH_AUTH_SOCK=null filezilla:

# copy filezilla.desktop to your home
sudo cp -t ~/.local/share/applications /usr/share/applications/filezilla.desktop
# change ownership
sudo chown $USER: ~/.local/share/applications/filezilla.desktop
# add env variable
sed -i  's/^\(Exec=\)\(filezilla\)/\1env SSH_AUTH_SOCK=null \2/' ~/.local/share/applications/filezilla.desktop
2
+50

you may fix this issue on your Mac by setting by below way:

setting the root password with "sudo passwd root" then
editing and saving the ssh config file with "nano /etc/ssh_config" and
changing the RSAAuthentication to "no" rather than yes.

if you have any more issues go with this link: https://serverfault.com/questions/36291/how-to-recover-from-too-many-authentication-failures-for-user-root

1
  • 1
    Ok, this pointed me in the right direction. What I did was edit the /etc/ssh/sshd_config on my servers and changed both RSAAuthentication and PubkeyAuthentication to no. I no longer have the issue and can now connect to all my servers. Thanks!
    – Jeremy
    Dec 11, 2014 at 16:51
1

the trace log has a line:

Pageant is running. Requesting keys.

Pageant has 10 SSH-2 keys

the sshd_config (on the server) has a setting MaxAuthTries which has default the value 6

so to prevent too many authentication attempts per connection, we need to lower the ssh-keys/identities

  1. comment all other Host entries, identityFiles in the ~/.ssh/config
  2. try moving unused keys in ~/.ssh/* to a new subdirectory (example: ~/.ssh/sftp-keys )
  3. use ssh-add -D to remove all identities from the agent.
  4. add the identity you want to use to connect ssh-add ~/ssh/sftp-keys/serverid_rsa

try to reconnect.

if still no success, please re-paste the new trace log.

3
  • I am already using IdentitiesOnly in my ssh config. Is there another spot I need to do this? I am using it like: IdentitiesOnly yes Should I use: =?
    – Jeremy
    Dec 11, 2014 at 16:43
  • Can you remove the IdentitiesOnly from the 'host *' entry
    – Rudger
    Dec 11, 2014 at 17:41
  • Only use "IdentitiesOnly yes" in combination with an IdentityFile
    – Rudger
    Dec 11, 2014 at 17:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .