Hi,

On 30 June 2015 at 00:19, Russell Coker <[email protected]> wrote:

> On Mon, 29 Jun 2015 10:34:07 PM Sean Crosby wrote:
> > On 29 June 2015 at 22:00, Russell Coker <[email protected]> wrote:
> > > Error1:
> > > ssh_exchange_identification: Connection closed by remote host
> > >
> > > Error2:
> > > ssh_exchange_identification: Connection closed by remote host
> > > rsync: connection unexpectedly closed (0 bytes received so far)
> > > [Receiver] rsync error: unexplained error (code 255) at io.c(605)
> > > [Receiver=3.0.9]
> >
> > I normally see this error when there's some authentication problem. In
> the
> > past, it has either been due to hosts.deny/hosts.allow rules,
>
> I think that the fact that it works from an interactive session rules out
> authentication problems.
>
> > or if the
> > server has no daemons available for authentication (the MaxStartups value
> > in sshd_config). I also think I've seen it when the nofile ulimit has
> been
> > reached for the user trying to authenticate.
>
> The default for MaxStartups is to rate limit connections when there are 10
> unauthenticated connections and to stop them entirely when there are 60
> unauthenticated connections.  A quick inspection by ps indicates no
> unauthenticated connections so I don't think this is the issue.



MaxStartups still could be a problem.
For example, if there are a group of client machines all trying to
fetch/upload stats to one central server simultaneously every */5 minutes.

A machine here has
===
# grep MaxS /etc/ssh/sshd_config
MaxStartups 5:30:10
===

Then if there are some attackers trying to guess passwords at the same time
as the cron jobs, the regular cron jobs can start failing intermittently.

    John

> Instead of trying an rsync, can you get the cron script to run a command
> > via ssh, with max verbosity? e.g.
> >
> > ssh -vvv user@server /usr/bin/id
> >
> > just to see where the ssh process is failing?
>
> That's a good idea.  However the system in question has inconveniently
> started
> working again.  I'll leave a cron job of that running until it breaks
> again.
>
> Thanks for the suggestions!
>
> --
> My Main Blog         http://etbe.coker.com.au/
> My Documents Blog    http://doc.coker.com.au/
> _______________________________________________
> luv-main mailing list
> [email protected]
> http://lists.luv.asn.au/listinfo/luv-main
>
_______________________________________________
luv-main mailing list
[email protected]
http://lists.luv.asn.au/listinfo/luv-main

Reply via email to