ssh_exchange_identification: read: Connection reset by peer

[Grayh]

This is a continuation of the thread http://forums13.itrc.hp.com/service/forums/questionanswer.do?admit=109447627+1227622458337+28353475&threadId=1291178.. To remove confusion I am doing this...

My issue is ssh get frequently disconnected with the following messages:-

And when SSh gets disconnected, Also telnet dosent work but I can still ping the server

ssh_exchange_identification: read: Connection reset by peer
ssh: connect to host port 22: Connection refused

Other Findings:-

# ps -ef | grep sshd
root 24563 5894 0 08:39:54 ? 0:00 sshd: root@pts/0
root 24678 24596 0 08:44:24 pts/0 0:00 grep sshd
root 5894 1 0 16:33:53 ? 0:00 /opt/ssh/sbin/sshd

Here are some more errors found ...

sshd[5894]: Server listening on :: port 22.
sshd[5894]: Server listening on 0.0.0.0 port 22.
sshd[5904]: error: Bind to port 22 on :: failed: Address already in use.
sshd[5904]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.

sshd[5904]: fatal: Cannot bind any address.


I also see many debugs when i issue the below command

# ssh -v hpbox01
OpenSSH_5.1p1+sftpfilecontrol-v1.2-hpn13v5, OpenSSL 0.9.7m 23 Feb 2007
HP-UX Secure Shell-A.05.10.007, HP-UX Secure Shell version
debug1: Reading configuration data /opt/ssh/etc/ssh_config
debug1: Connecting to hpbox01 [10.3.20.23] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/3
debug1: identity file /.ssh/identity type -1
debug1: identity file /.ssh/id_rsa type -1
debug1: identity file /.ssh/id_dsa type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_5.1p1+sftp
filecontrol-v1.2-hpn13v5
debug1: match: OpenSSH_5.1p1+sftpfilecontrol-v1.2-hpn13v5 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.1p1+sftpfilecontrol-v1.2-hpn13v5
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: AUTH STATE IS 0
debug1: REQUESTED ENC.NAME is 'aes128-cbc'
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: REQUESTED ENC.NAME is 'aes128-cbc'
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
The authenticity of host 'hpbox01 (10.3.20.23)' can't be established.
RSA key fingerprint is 90:a8:40:29:74:aa:17:43:b0:df:f4:a7:59:3b:b2:5e.
Are you sure you want to continue connecting (yes/no)? y
Please type 'yes' or 'no': yes
Warning: Permanently added 'hpbox01,10.3.20.23' (RSA) to the list of known hosts.
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interacti
ve
debug1: Next authentication method: publickey
debug1: Trying private key: /.ssh/identity
debug1: Trying private key: /.ssh/id_rsa
debug1: Trying private key: /.ssh/id_dsa
debug1: Next authentication method: keyboard-interactive
Password:

How will I be able to resolve this..

[Grayh]

Any Idea on this

[Grayh]

I have the latest version of SSH installed


T1471AA A.05.10.007 HP-UX Secure Shell

[Steven Schweda]

> This is a continuation of the thread
> [...]

When you cite a thread here, it's best to
omit the "11", "12", or "13" from the host
name, and also to omit the "admit=" piece of
the URL:

http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1291178

It's also safer from stray punctuation (like
"..") on a line of its own.

> ssh: connect to host port 22: Connection refused

"Connection refused" normally means that the
server (here, "sshd") is not running (or
configured to run).

> sshd[5904]: error: Bind to port 22 on :: failed: Address already in use.

You can run only one "sshd" at a time (on
the same port at the same IP address).

> debug1: Trying private key: /.ssh/identity
> debug1: Trying private key: /.ssh/id_rsa
> debug1: Trying private key: /.ssh/id_dsa
> debug1: Next authentication method: keyboard-interactive

Apparently, those keys were bad (according
to the server).

You might see if you can correlate error
messages in the server's system log files
with these actions on the client.

[Ganesan R]

Hi Grayh,

It doesn't seems to be SSH issue. Because telnet is also not working at the same time.

I would go with updating all network patches. Or install the latest patch bundle which has all network subsystem patches.

[G V R Shankar · Accepted solution]

Hi,
I couldn't read the URL, as the servers are down.

If you have already done the following, please ignore it.

There could be a dupluicate IP in the n/w. Please run the following commads

ll /var/adm/nettl*

I assume that /var/adm/nettl.LOG000 has the latest timestamp

netfmt -F -t 15
/var/adm/nettl.LOG000

You would know if there is duplicate IP

Cheers,
Ravi.

[Grayh]

Thanks everyone...

# ll /var/adm/nettl*
-rw-r--r-- 1 root root 69041 Nov 25 10:40 /var/adm/nettl.LOG000
# netfmt -F -t 15

Usage : netfmt [ -s ] [ -p ] [ -c config_file ]
[ -k ] [ -t records ] [ -F ]
[ -v ] [ -l ] [ -n ] [ -N | [ -1 [ -LT [ D ] ] ] ]
[ [ -k ] [ -f ] input_file ]


netfmt Cannot read from a terminal.
Specify input file via the -f option,
redirecting standard input, or from a pipe.

I am not able to make out if there is a duplicate IP present


I have some errors showing up when I run the below command
netfmt -t 50 -f /var/adm/nettl.LOG000

32 09:53:36 6927510 1 T.. 0 0 IP: Hardware address '00:50:56:ba:7c:6a' trying to
be our address 010.003.090.050!

-----------------------------------STREAMS/UX-------------------------------@#%
Timestamp : Tue Nov 25 EST 2008 10:12:23.328798
Process ID : [ICS] Subsystem : STREAMS
User ID ( UID ) : -1 Log Class : ERROR
Device ID : 0 Path ID : 0
Connection ID : 0 Log Instance : 0
Location : 00123
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
33 10:12:23 7040231 1 T.. 0 0 IP: Hardware address '00:50:56:ba:7c:6a' trying to
be our address 010.003.090.050!

-----------------------------------STREAMS/UX-------------------------------@#%
Timestamp : Tue Nov 25 EST 2008 10:31:26.109416
Process ID : [ICS] Subsystem : STREAMS
User ID ( UID ) : -1 Log Class : ERROR
Device ID : 0 Path ID : 0
Connection ID : 0 Log Instance : 0
Location : 00123
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
34 10:31:26 7154509 1 T.. 0 0 IP: Hardware address '00:50:56:ba:7c:6a' trying to
be our address 010.003.090.050!

-----------------------------------STREAMS/UX-------------------------------@#%
Timestamp : Tue Nov 25 EST 2008 10:40:34.280151
Process ID : [ICS] Subsystem : STREAMS
User ID ( UID ) : -1 Log Class : ERROR
Device ID : 0 Path ID : 0
Connection ID : 0 Log Instance : 0
Location : 00123
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
35 10:40:34 7209327 1 T.. 0 0 IP: Hardware address '00:50:56:ba:7c:6a' trying to
be our address 010.003.090.050!

If I have to install the ntwk. patches... which all nwtk patches do i have to Install.. Plz Advise

[G V R Shankar]

Hi

There is another system in your network which has the same IP.

35 10:40:34 7209327 1 T.. 0 0 IP: Hardware address '00:50:56:ba:7c:6a' trying to
be our address 010.003.090.050!

Please conatct the network team to identify the lan card which has the MAC 010.003.090.050!

Cheers,

Ravi.

[Grayh]

010.003.090.050 is the IP of the server in question...

Dont know what 00:50:56:ba:7c:6a is..

looks like some ip ending with 106...

What would be my next step

[G V R Shankar]

TO resolve the issue, please change the IP adderess on the server.

OR

lanscan|grep -i 010003090050
lanscan |grep -i 005056ba7c6a

One LAN interface would be present on your server. The other MAC address will be some other system in the n/w. Please identify the system, shutdown it, the issue will be resolved.

Cheers,

Ravi

[Grayh]

# lanscan
Hardware Station Crd Hdw Net-Interface NM MAC HP-DLPI DLPI
Path Address In# State NamePPA ID Type Support Mjr#
0/2/2/0 0x001F29F280AA 2 UP lan2 snap2 1 ETHER Yes 119
0/1/1/0 0x001F29F280AC 0 UP lan0 snap0 2 ETHER Yes 119
0/1/1/1 0x001F29F280AD 1 UP lan1 snap1 3 ETHER Yes 119
0/2/2/1 0x001F29F280AB 3 UP lan3 snap3 4 ETHER Yes 119

It does not show any of the mac addresses listed in the error

[G V R Shankar]

Do you have APA or VLAN configured?

netstat -ni
lanscan -V scan
lanscan -q

If possible, please change the IP address on your server. This will solve the problem.

Ravi.

[Ivan Krastev]

From errors:
>Here are some more errors found ...

>sshd[5894]: Server listening on :: port 22.
>sshd[5894]: Server listening on 0.0.0.0 port 22.
>sshd[5904]: error: Bind to port 22 on :: >failed: Address already in use.
>sshd[5904]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.

>sshd[5904]: fatal: Cannot bind any address.


try to stop ssh daemon:
#/sbin/init.d/secsh stop (or what is your start/stop script)

check for running daemon :

#ps -ef | grep sshd

check for process, using the port:

#lsof -i tcp | grep 22

start sshd daemon.

regards,
ivan

[Grayh]

Thanks every One It was due to IP COnflict and now it has been resolved

[Grayh]

Thanks Again