How to recover from "Too many Authentication Failures for user root"
I've done several attempts to establish SSH-connecton for user root@host using putty terminal. While doing so I specified wrong credentials several times and after that I've specified them correctly, and then after the credentials were accepted the ssh session breaks with
"Server unexpectedly closed network connection".
This error is reported by putty terminal. When trying to ssh root@localhost from the local console - it works fine. It also works fine when I ssh otheruser@host from other host. So network connectivity issues are not guilty. The only error I am thinking of is: Too many Authentication Failures for user root although putty reported a different error.
How Fix Too many Authentication Failures for user
This is usually caused by inadvertently offering multiple ssh keys to the server. The server will reject any key after too many keys have been offered. How many time ssh client can try establish connection with different keys or username/passord is defined by the
MaxAuthTries setting in /etc/ssh/sshd_config. I have configure
You can see this for yourself by adding the -v flag to your ssh command to get verbose output. You will see that a bunch of keys are offered, until the server rejects the connection saying: Too many authentication failures for [user]. Without verbose mode, you will only see the ambiguous message Connection reset by peer.
$ ssh -v email@example.com OpenSSH_7.4p1 Debian-10+deb9u6, OpenSSL 1.0.2r 26 Feb 2019 ... debug1: Authentications that can continue: publickey,password debug1: Next authentication method: publickey debug1: Offering public key: RSA SHA256:uJ5jgxD4qzfAHzP26U0HQpFS0x1FrQ9TCp4Qn7VaGNk /c/Users/root/.ssh/id_rsa debug1: Authentications that can continue: publickey,password debug1: Trying private key: /c/Users/root/.ssh/id_dsa debug1: Offering public key: ECDSA SHA256:h1V2BAfnynPUZZF6uK92krYeHMNcQJJbP3/2jM1n1MY /c/Users/root/.ssh/id_ecdsa Received disconnect from 192.168.89.181 port 22:2: Too many authentication failures for root from 192.168.2.48 port 23315 ssh2 Disconnected from 192.168.89.181 port 22
Solution 1 (Quick Solution)
If you have a username/password, and want to simply use the password to login, here is how you do it.
To use ONLY password authentication and NOT use Public-key, and NOT use the somewhat misleading "keyboard-interactive" (which is a superset including password), you can do this from the command line:
$ ssh -o PreferredAuthentications=password firstname.lastname@example.org
If you have a number of private keys in your .ssh directory you can disable "Public Key Authentication" at the command line using the '-o' optional argument. It's very similar as in Solution 1
$ ssh -o PubkeyAuthentication=no email@example.com
From manual pages for ssh - man ssh:
-i identity_file Selects a file from which the identity (private key) for public key authentication is read. The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 and ~/.ssh/id_rsa for protocol version 2. Identity files may also be specified on a per-host basis in the configuration file. It is possible to have multiple -i options (and multiple identities specified in configura‐ tion files). ssh will also try to load certificate information from the filename obtained by appending -cert.pub to identity filenames.
You can exactly specify what identity key you want use:
$ ssh -o IdentitiesOnly=yes -i ~/.ssh/example_rsa example.com
Specifiy, explicitly, which key goes to which host(s) in your .ssh/config file.
You need to configure which key ("IdentityFile") goes with which domain (or host). You also want to handle the case when the specified key doesn’t work, which would usually be because the public key isn’t in ~/.ssh/authorized_keys on the server. The default is for SSH to then try any other keys it has access to, which takes us back to too many attempts. Setting "IdentitiesOnly" to "yes" tells SSH to only try the specified key and, if that fails, fall through to password authentication (presuming the server allows it).
Your ~/.ssh/config would look like:
Host *.myhost.com IdentitiesOnly yes IdentityFile ~/.ssh/myhost Host secure.myhost.com IdentitiesOnly yes IdentityFile ~/.ssh/mysecurehost_rsa Host *.myotherhost.domain IdentitiesOnly yes IdentityFile ~/.ssh/myotherhost_rsa
Host is the host the key can connect to
IdentitiesOnly means only to try this specific key to connect, no others
IdentityFile is the path to the key.
You can try multiple keys if needed
Host *.myhost.com IdentitiesOnly yes IdentityFile ~/.ssh/myhost_rsa IdentityFile ~/.ssh/myhost_dsa