How to fix kex_exchange_identification: Connection closed by remote host in SSH

On the server, check if your IP has been blocked by fail2ban or firewall rules:

# Check fail2ban status
sudo fail2ban-client status sshd

# Check hosts.deny and hosts.allow
sudo cat /etc/hosts.deny
sudo cat /etc/hosts.allow

# Check iptables rules (if using iptables)
sudo iptables -L -n | grep ssh

If your IP is blocked, unblock it:

# Unblock IP from fail2ban
sudo fail2ban-client set sshd unbanip <your-ip>

On your client machine, use verbose mode to see exactly where the connection fails:

ssh -vvv user@hostname

The -vvv flag gives maximum verbosity. Look for the point where the connection closes and note what phase it's in. Share relevant log lines with the server administrator if needed.

On the server, check the SSH daemon logs to see why it closed the connection:

# For systemd-based systems
sudo journalctl -u sshd -n 50 --no-pager

# For syslog-based systems
sudo tail -n 50 /var/log/auth.log
sudo tail -n 50 /var/log/secure

Look for messages like:
- "Too many authentication failures"
- "Received disconnect from"
- "Unable to load host key"
- "sshd: no more sessions"

These messages will indicate the exact cause.

On the server, ensure the SSH daemon is running and restart it:

# Check if sshd is running
sudo systemctl status sshd

# Restart the SSH daemon
sudo systemctl restart sshd

# Check for configuration errors before restarting
sudo sshd -t

The -t flag tests the configuration without starting the daemon. If it shows errors, fix them before restarting.

If the server was recently upgraded or its keys regenerated, your client's known_hosts file may be outdated:

# Remove old host key from known_hosts
ssh-keygen -R hostname
ssh-keygen -R 192.168.1.100

# Try connecting again (you'll be prompted to accept the new key)
ssh user@hostname

On the server, check the SSH daemon configuration:

sudo nano /etc/ssh/sshd_config

Look for the MaxStartups parameter (default is 10:30:60). If the server is receiving many concurrent connections, increase it:

MaxStartups 50:30:100

This allows up to 50 simultaneous pending connections. After modifying, test and restart:

sudo sshd -t
sudo systemctl restart sshd

If host keys are missing or have incorrect permissions:

# Check host key permissions
sudo ls -la /etc/ssh/ssh_host_*

# Host keys should have these permissions:
# Private keys: 600 (-rw-------)
# Public keys: 644 (-rw-r--r--)

# Fix if needed
sudo chmod 600 /etc/ssh/ssh_host_*_key
sudo chmod 644 /etc/ssh/ssh_host_*_key.pub

If keys are corrupted or missing, regenerate them:

sudo ssh-keygen -A
sudo systemctl restart sshd

If you're connecting to an old SSH server that doesn't support modern algorithms, explicitly specify a compatible one:

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 user@hostname

Warning: Older algorithms are less secure. Use this only as a temporary workaround while upgrading the server.

Alternatively, check available algorithms:

ssh -Q kex           # Key exchange algorithms
ssh -Q cipher        # Cipher algorithms
ssh -Q mac           # MAC algorithms