4

After upgrading my Ubuntu Server from release 13.04 to 13.10 (do-release-upgrade), I can not connect to the server anymore, SSH closing connections immediately (after sending SSH2_MSG_KEXINIT). It worked well before upgrade and restart of the server.

~$ ssh -v superuser@MYHOST
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
[...]
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.2p2 Ubuntu-6ubuntu0.1
debug1: match: OpenSSH_6.2p2 Ubuntu-6ubuntu0.1 pat OpenSSH*
debug1: SSH2_MSG_KEXINIT sent
Connection closed by 123.123.123.123

As I had versioned the system configuration files, I can see that /etc/hosts.allow, /etc/hosts.deny did not change, nor did /etc/ssh/sshd_config.

I checked some similar questions on AskUbuntu, StackExchange and SuperUser, but none of them solves this case, so I'm submitting it again.

A few issues I checked:

  1. AskUbuntu · Upgrade from 13.04 to 13.10 broke remote SSH access? · 10.11.2013
  2. Superuser · Not able to connect with server. Connection closed by remote server · 10.08.2013
  3. StackOverflow · SSH: Connection closed by remote server · 08.08.2013
  4. StackOverflow · ssh connection stop at “debug1: SSH2_MSG_KEXINIT sent” [closed] · 4.03.2010
  • 1
    Try connecting with very verbose ssh -vvv name@remote to see if the additional output reveals anything. – Sean Feb 21 '14 at 14:10
  • Thanks for the hint. I tried it, but it did not reveal anything more useful. I solved the issue in the meantime, which was related to the permissions of the private key files in /etc/ssh/ on the server. I'll post a detailed answer in a couple of hours; I can't for now, not having enough karma out here. – olange Feb 21 '14 at 14:32
2

Examining the log file /var/log/auth.log on the server, to which I connected thru the KVM-over-IP console, I found out that the SSH daemon was ignoring the server private key files ssh_host_rsa_key, ssh_host_dsa_key, ssh_host_ecdsa_key, while complaining about their permissions:

# tail -f /var/log/auth.log
[…]
Feb 21 13:49:18 MYHOST sshd[14646]: error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Feb 21 13:49:18 MYHOST sshd[14646]: error: @         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
Feb 21 13:49:18 MYHOST sshd[14646]: error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Feb 21 13:49:18 MYHOST sshd[14646]: error: Permissions 0644 for '/etc/ssh/ssh_host_rsa_key' are too open.
Feb 21 13:49:18 MYHOST sshd[14646]: error: It is required that your private key files are NOT accessible by others.
Feb 21 13:49:18 MYHOST sshd[14646]: error: This private key will be ignored.
Feb 21 13:49:18 MYHOST sshd[14646]: error: bad permissions: ignore key: /etc/ssh/ssh_host_rsa_key
Feb 21 13:49:18 MYHOST sshd[14646]: error: Could not load host key: /etc/ssh/ssh_host_rsa_key
[…]

I restricted the permissions and restarted the SSH daemon, which solved my issue:

# cd /etc/ssh
# chmod go-r *
# initctl restart ssh
0

For me this was happening because of incorrect MTU settings while using a PPTP vpn. This fixed the issue for me:

sudo ip link set ppp0 mtu 1400

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.