Hi,

On 30 June 2015 at 00:19, Russell Coker <russell@coker.com.au> wrote:
On Mon, 29 Jun 2015 10:34:07 PM Sean Crosby wrote:
> On 29 June 2015 at 22:00, Russell Coker <russell@coker.com.au> wrote:
> > Error1:
> > ssh_exchange_identification: Connection closed by remote host
> >
> > Error2:
> > ssh_exchange_identification: Connection closed by remote host
> > rsync: connection unexpectedly closed (0 bytes received so far)
> > [Receiver] rsync error: unexplained error (code 255) at io.c(605)
> > [Receiver=3.0.9]
>
> I normally see this error when there's some authentication problem. In the
> past, it has either been due to hosts.deny/hosts.allow rules,

I think that the fact that it works from an interactive session rules out
authentication problems.

> or if the
> server has no daemons available for authentication (the MaxStartups value
> in sshd_config). I also think I've seen it when the nofile ulimit has been
> reached for the user trying to authenticate.

The default for MaxStartups is to rate limit connections when there are 10
unauthenticated connections and to stop them entirely when there are 60
unauthenticated connections.  A quick inspection by ps indicates no
unauthenticated connections so I don't think this is the issue.


MaxStartups still could be a problem.
For example, if there are a group of client machines all trying to fetch/upload stats to one central server simultaneously every */5 minutes.

A machine here has
===
# grep MaxS /etc/ssh/sshd_config
MaxStartups 5:30:10
===

Then if there are some attackers trying to guess passwords at the same time as the cron jobs, the regular cron jobs can start failing intermittently.

    John

> Instead of trying an rsync, can you get the cron script to run a command
> via ssh, with max verbosity? e.g.
>
> ssh -vvv user@server /usr/bin/id
>
> just to see where the ssh process is failing?

That's a good idea.  However the system in question has inconveniently started
working again.  I'll leave a cron job of that running until it breaks again.

Thanks for the suggestions!

--
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/
_______________________________________________
luv-main mailing list
luv-main@luv.asn.au
http://lists.luv.asn.au/listinfo/luv-main