How to fix ssh_exchange_identification: Connection closed by remote host in SSH

SSHINTERMEDIATEMEDIUMUpdated May 28, 2026· 273 views

The SSH server closed the connection before key exchange completed. Usually caused by IP blocking, fail2ban bans, MaxStartups limits, resource exhaustion, or a misbehaving sshd.

Quick fix

Fixes ssh_exchange_identification: Connection closed by remote host

ssh -vvv user@hostname
  1. Enable verbose SSH output to diagnose the connection
  2. Check if your IP is banned by Fail2ban
  3. Check if your IP is blocked by TCP wrappers
  4. Check SSH server status and logs
ssh — error
ssh -vvv user@hostname
ssh_exchange_identification: Connection closed by remote host

What this error means

The 'ssh_exchange_identification: Connection closed by remote host' error means the SSH daemon on the remote server abruptly terminated the connection before the identification and authentication process could begin. This happens at the protocol level, before your credentials are even evaluated, indicating either a server-side policy enforcement, resource constraint, or daemon malfunction. The connection is severed during the initial TCP handshake or early SSH protocol phase, so it is not an authentication problem — your key or password is never reached.

Typical symptoms

  • SSH connection attempt immediately fails with no prompt for password or key
  • Error message appears before any authentication prompts
  • Connection succeeds sometimes but fails other times
  • Works from some IP addresses but not others
  • SSH works fine from one machine but fails from another
  • Recent changes to server configuration preceded the error

Common causes

  1. Fail2ban or similar intrusion detection system has banned your IP due to too many failed login attempts
  2. IP address is blocked by /etc/hosts.deny or TCP wrappers configuration
  3. SSH server's MaxStartups limit reached (too many unauthenticated connections)
  4. Firewall or network ACL is dropping the connection
  5. Server is out of memory or running out of system resources
  6. SSH daemon (sshd) is not running properly or has crashed
  7. DNS reverse lookup timeout causing sshd to drop connection (if UseDNS is enabled)
  8. Server's host SSH keys are corrupted or missing
  9. Port forwarding or SSH tunnel misconfiguration on the server

How to fix "ssh_exchange_identification: Connection closed by remote host"

1Enable verbose SSH output to diagnose the connection

Run your SSH command with maximum verbosity to see exactly where the connection is failing:

bash
ssh -vvv user@hostname

Look for output like:
- 'debug1: Local version string: OpenSSH_X.X'
- 'debug1: Remote protocol version X.X, remote software version OpenSSH_X.X'
- 'debug1: match: OpenSSH_X.X'

If you don't see 'Remote protocol version', the server is closing before SSH negotiation completes.

2Check if your IP is banned by Fail2ban

Because this error appears before authentication, an automated ban is the single most common cause. If you have server access, check the Fail2ban status and the list of currently banned IPs:

bash
# Show jail status, including the 'Banned IP list'
sudo fail2ban-client status sshd

On newer Fail2ban versions you can also list bans directly:

bash
sudo fail2ban-client get sshd banned

If your IP appears in the list, unban it:

bash
sudo fail2ban-client set sshd unbanip YOUR_IP_ADDRESS

If this is a repeated issue, ask your administrator to adjust Fail2ban sensitivity or whitelist your IP range via the ignoreip directive in /etc/fail2ban/jail.local.

3Check if your IP is blocked by TCP wrappers

Log into the server (or ask your administrator) and examine the TCP wrapper rules:

bash
cat /etc/hosts.deny
cat /etc/hosts.allow

If you see lines like 'sshd: ALL' in hosts.deny or specific IP restrictions in hosts.allow, your IP may be blocked. Ask your administrator to add your IP to hosts.allow:

bash
# Add to /etc/hosts.allow
sshd: YOUR_IP_ADDRESS
sshd: 192.168.1.0/24

Note: TCP wrapper support (libwrap) was removed from OpenSSH 6.7+, so these files only apply if your sshd was explicitly built with libwrap or another wrapped service is involved.

4Check SSH server status and logs

On the remote server, verify the SSH daemon is running:

bash
sudo systemctl status sshd

Restart the SSH service to clear potential stuck connections:

bash
sudo systemctl restart sshd

Examine SSH logs for clues:

bash
# Debian/Ubuntu
sudo tail -f /var/log/auth.log

# RHEL/CentOS/Fedora
sudo tail -f /var/log/secure

# systemd journal (any distro)
sudo journalctl -u sshd -f

# Look for messages like:
# sshd[xxxx]: Connection closed by authenticating user
# sshd[xxxx]: fatal: setgroups: Cannot allocate memory
# sshd[xxxx]: error: beginning MaxStartups throttling
# sshd[xxxx]: Connection reset by peer
5Check SSH server configuration limits

Examine /etc/ssh/sshd_config for overly restrictive settings:

bash
sudo grep -E 'MaxStartups|MaxSessions|LoginGraceTime|UseDNS' /etc/ssh/sshd_config

If MaxStartups is too low (default is 10:30:100), increase it:

bash
# Edit /etc/ssh/sshd_config
MaxStartups 30:30:100

Validate the configuration before applying it, then reload:

bash
sudo sshd -t && sudo systemctl reload sshd
6Disable reverse DNS lookup if it's timing out

If DNS lookups are slow or failing, they can delay or drop incoming connections. Add this to /etc/ssh/sshd_config:

bash
UseDNS no

Then validate and reload SSH:

bash
sudo sshd -t && sudo systemctl reload sshd
7Check server resources and restart SSH daemon

The server might be out of memory or system resources, which can cause sshd to fail to fork new sessions. Check:

bash
free -m          # Check available memory
df -h            # Check disk space
top -bn1 | head  # Check CPU and memory usage

If the server is low on resources, free up memory or disk space first. Then restart the SSH daemon:

bash
sudo systemctl restart sshd
8Verify or regenerate SSH host keys

Missing or corrupted host keys can cause sshd to fail to start its protocol. Check whether they exist:

bash
ls -la /etc/ssh/ssh_host_*

If they're missing or corrupted, regenerate them:

bash
# Debian/Ubuntu
sudo dpkg-reconfigure openssh-server

# RHEL/CentOS/Fedora (generates any missing default host keys)
sudo ssh-keygen -A

Then restart SSH:

bash
sudo systemctl restart sshd

Note: if a host key changed, clients will see a separate host-key-verification warning the next time they connect; that is expected after regeneration.

Advanced notes

The 'Connection closed by remote host' message during ssh_exchange_identification indicates the server-side sshd process is terminating the connection before the SSH protocol negotiation phase completes. This is different from authentication failures, which occur later in the handshake. Common advanced scenarios include: (1) SELinux or AppArmor policies preventing sshd from binding to ports or accessing required libraries — check 'sudo ausearch -m avc -ts recent' for SELinux denials rather than disabling enforcement; (2) systemd socket activation misconfiguration where ListenAddress directives don't match the ssh.socket unit; (3) connection rate limiting via iptables, e.g. 'iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --set' paired with a '--update --seconds 60 --hitcount 10 -j DROP' rule — overly aggressive limits will drop legitimate connections; (4) IPv4 vs IPv6 mismatch — set 'AddressFamily any' if you need both, and confirm the client is reaching the address family sshd listens on; (5) on containerized systems, ensure sshd is properly initialized and not hitting the container's connection or PID limits. For production troubleshooting, enable debug-level logging: run a foreground instance on an alternate port with 'sudo /usr/sbin/sshd -d -p 2222' to inspect a single connection, or set 'LogLevel DEBUG' in sshd_config and check logs immediately after the failed connection attempt.

Frequently asked questions

What does "ssh_exchange_identification: Connection closed by remote host" mean?
The 'ssh_exchange_identification: Connection closed by remote host' error means the SSH daemon on the remote server abruptly terminated the connection before the identification and authentication process could begin. This happens at the protocol level, before your credentials are even evaluated, indicating either a server-side policy enforcement, resource constraint, or daemon malfunction. The connection is severed during the initial TCP handshake or early SSH protocol phase, so it is not an authentication problem — your key or password is never reached.
How do I fix "ssh_exchange_identification: Connection closed by remote host"?
The SSH server closed the connection before key exchange completed. Usually caused by IP blocking, fail2ban bans, MaxStartups limits, resource exhaustion, or a misbehaving sshd.
What causes "ssh_exchange_identification: Connection closed by remote host"?
Fail2ban or similar intrusion detection system has banned your IP due to too many failed login attempts IP address is blocked by /etc/hosts.deny or TCP wrappers configuration SSH server's MaxStartups limit reached (too many unauthenticated connections)
Is the "ssh_exchange_identification: Connection closed by remote host" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading