ssh_exchange_identification: read: Connection reset by peer

[Grayh]

This is a continuation of the thread http://forums13.itrc.hp.com/service/forums/questionanswer.do?admit=109447627+1227622458337+28353475&threadId=1291178.. To remove confusion I am doing this...

My issue is ssh get frequently disconnected with the following messages:-

And when SSh gets disconnected, Also telnet dosent work but I can still ping the server

ssh_exchange_identification: read: Connection reset by peer
ssh: connect to host port 22: Connection refused

Other Findings:-

# ps -ef | grep sshd
root 24563 5894 0 08:39:54 ? 0:00 sshd: root@pts/0
root 24678 24596 0 08:44:24 pts/0 0:00 grep sshd
root 5894 1 0 16:33:53 ? 0:00 /opt/ssh/sbin/sshd

Here are some more errors found ...

sshd[5894]: Server listening on :: port 22.
sshd[5894]: Server listening on 0.0.0.0 port 22.
sshd[5904]: error: Bind to port 22 on :: failed: Address already in use.
sshd[5904]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.

sshd[5904]: fatal: Cannot bind any address.


I also see many debugs when i issue the below command

# ssh -v hpbox01
OpenSSH_5.1p1+sftpfilecontrol-v1.2-hpn13v5, OpenSSL 0.9.7m 23 Feb 2007
HP-UX Secure Shell-A.05.10.007, HP-UX Secure Shell version
debug1: Reading configuration data /opt/ssh/etc/ssh_config
debug1: Connecting to hpbox01 [10.3.20.23] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/3
debug1: identity file /.ssh/identity type -1
debug1: identity file /.ssh/id_rsa type -1
debug1: identity file /.ssh/id_dsa type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_5.1p1+sftp
filecontrol-v1.2-hpn13v5
debug1: match: OpenSSH_5.1p1+sftpfilecontrol-v1.2-hpn13v5 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.1p1+sftpfilecontrol-v1.2-hpn13v5
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: AUTH STATE IS 0
debug1: REQUESTED ENC.NAME is 'aes128-cbc'
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: REQUESTED ENC.NAME is 'aes128-cbc'
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
The authenticity of host 'hpbox01 (10.3.20.23)' can't be established.
RSA key fingerprint is 90:a8:40:29:74:aa:17:43:b0:df:f4:a7:59:3b:b2:5e.
Are you sure you want to continue connecting (yes/no)? y
Please type 'yes' or 'no': yes
Warning: Permanently added 'hpbox01,10.3.20.23' (RSA) to the list of known hosts.
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interacti
ve
debug1: Next authentication method: publickey
debug1: Trying private key: /.ssh/identity
debug1: Trying private key: /.ssh/id_rsa
debug1: Trying private key: /.ssh/id_dsa
debug1: Next authentication method: keyboard-interactive
Password:

How will I be able to resolve this..

[Armin Kunaschik · Accepted solution]

To me this looks like (probably temporary) exhaustion of system memory.
Do you have any unusual messages in /var/adm/syslog/syslog.log like "can not fork" or "malloc" errors? Your applications are probably affected too.. do you have any logfiles with error messages?
Does this problem go away after quite some time or do you need to reboot?
If it's like that you need to take a look to your general system ressources, and maybe increase system memory.

My 2 cents,
Armin

[yulianto piyut]

have you tried to restart the sshd daemon? or maybe you can upgrade your openssh.

[Suraj K Sankari]

Hi,
If possible just remove the ssh software and reinstall it with newer version.

http://hpux.connect.org.uk/hppd/hpux/Networking/Admin/openssh-5.1p1/

or

http://openssh.org/openbsd.html

Suraj

[Steven Schweda]

This thread appears to be the result of a
duplicate posting. The other half is already
closed:

http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1291605

It would have been nice if the poster had
taken the time to close this thread, too, but
it hasn't happened.

[Grayh]

Thanks uyou