/codes/ssh-protocol/ssh-disconnect-reason-codes
SSH disconnect reason codes: "Received disconnect from HOST port 22:2" explained
The commands on this page have not been executed by our verification runner yet.updated
- tool
- SSH protocol
- versions
- SSH-2 (RFC 4253, RFC 4250)
- os
- any
When an SSH connection is closed with an SSH_MSG_DISCONNECT message, it carries a numeric reason code and a text description. OpenSSH prints both: in Received disconnect from 203.0.113.5 port 22:2: Too many authentication failures, 2 is the reason code (SSH_DISCONNECT_PROTOCOL_ERROR) and the rest is the text the other side sent. The code is often generic; the text, and the server's log, say what really happened.
Reason codes (RFC 4253, section 11.1)
| Code | Name | Typical situation |
|---|---|---|
| 1 | SSH_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT | The server refuses this client address (access rules, fail2ban-style blocks in some servers) |
| 2 | SSH_DISCONNECT_PROTOCOL_ERROR | Used by OpenSSH for many refusals, including "Too many authentication failures" |
| 3 | SSH_DISCONNECT_KEY_EXCHANGE_FAILED | Key exchange could not complete |
| 4 | SSH_DISCONNECT_RESERVED | Reserved, not used |
| 5 | SSH_DISCONNECT_MAC_ERROR | A packet failed integrity checking (corruption, a broken middlebox) |
| 6 | SSH_DISCONNECT_COMPRESSION_ERROR | Decompression failed |
| 7 | SSH_DISCONNECT_SERVICE_NOT_AVAILABLE | The requested service (ssh-userauth, ssh-connection) is not offered |
| 8 | SSH_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED | The peer speaks an unsupported protocol version (SSH-1) |
| 9 | SSH_DISCONNECT_HOST_KEY_NOT_VERIFIABLE | The host key could not be verified |
| 10 | SSH_DISCONNECT_CONNECTION_LOST | The connection was lost |
| 11 | SSH_DISCONNECT_BY_APPLICATION | Normal close: the user logged out, or the server closed an idle session |
| 12 | SSH_DISCONNECT_TOO_MANY_CONNECTIONS | Connection limit reached on the server |
| 13 | SSH_DISCONNECT_AUTH_CANCELLED_BY_USER | The user cancelled authentication |
| 14 | SSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE | All authentication methods failed |
| 15 | SSH_DISCONNECT_ILLEGAL_USER_NAME | The user name is not acceptable |
Codes 0xFE000000 to 0xFFFFFFFF are reserved for private use; IANA keeps the registry of assigned values.
Common messages
Received disconnect from HOST port 22:2: Too many authentication failures: the client tried more keys than the server'sMaxAuthTries(default 6) allows, usually because an SSH agent holds many keys. Pick the key explicitly with-i ~/.ssh/key -o IdentitiesOnly=yes, or setIdentitiesOnly yesfor the host in~/.ssh/config.Received disconnect from HOST port 22:11: ...: a normal, application-level close. If it happens right after login, check the server's log for a forced command, aMatchblock or a shell that exits.
Find the real cause
ssh -v user@host # client side: which keys were offered, where it stopped
sudo journalctl -u ssh -u sshd -n 50 # server side on systemd distributions
sudo tail -n 50 /var/log/auth.log # Debian and Ubuntu without journaldThe server log contains the reason in plain words (for example maximum authentication attempts exceeded), which the code alone does not show.
Sources
Related pages
errors · ssh-protocolUnable to negotiate: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1The SSH server offers only old key exchange such as diffie-hellman-group1-sha1. Upgrade it, or enable that algorithm for this one host with KexAlgorithms +.errors · ssh-protocolUnable to negotiate with HOST port 22: no matching host key type found. Their offer: ssh-rsaOpenSSH 8.8+ disables ssh-rsa SHA-1 signatures, so old servers fail with no matching host key type found. Upgrade them or allow +ssh-rsa for that host only.errors · sshPermission denied (publickey) with sshssh fails with Permission denied (publickey) when the server accepts only keys and none you offer is authorized. Check the key, the user and file permissions.commands · ssh-protocolssh -Q: list supported ciphers, kex, MACs and key typesssh -Q cipher, kex, mac, key and sig list the algorithms OpenSSH supports, even disabled ones. ssh -G shows what a host is offered; sshd -T the server.