How to fix kex_exchange_identification: read: Connection reset by peer in SSH

First verify that the remote server is reachable:

ping <server-ip>
traceroute <server-ip>
telnet <server-ip> 22

If ping fails or traceroute hangs, you have a network connectivity issue. If telnet connects and immediately disconnects, the SSH server is running but rejecting your connection.

From the server (if you have local access or another login method), check fail2ban status:

sudo fail2ban-client status sshd
sudo fail2ban-client set sshd unbanip <your-ip>

If your IP appears in the 'Banned IP list', unban it using the second command. This is the most common cause of this error.

If you have local server access or another login method:

sudo systemctl status ssh
sudo systemctl status sshd

If the service is inactive:

sudo systemctl start ssh

Or if using older init systems:

sudo service ssh start

On the server, verify port 22 is open:

sudo iptables -L -n | grep 22
sudo ufw status

On the client, check if your firewall or ISP is blocking outbound SSH:

telnet <server-ip> 22

If using a cloud provider (AWS, Azure, GCP), check the security group or firewall rules to ensure inbound TCP 22 is allowed from your IP.

From the server:

ls -la /etc/ssh/ssh_host_*

You should see files like ssh_host_rsa_key, ssh_host_ed25519_key, etc. If they are missing or the directory is empty, regenerate them:

sudo ssh-keygen -A
sudo systemctl restart ssh

Run your SSH command with increased verbosity:

ssh -vvv user@hostname

The output will show exactly where the connection fails. Look for lines like:
- 'SSH2_MSG_KEXINIT sent' - if you see this and then 'Connection reset', the server is dropping you during KEX
- 'Authentications that can continue' - you got past KEX, so the issue is authentication

If the server is under heavy load:

sudo grep MaxStartups /etc/ssh/sshd_config

Default is 10:30:60 (max 10 concurrent unauthenticated connections). If your server has high traffic:

# In /etc/ssh/sshd_config:
MaxStartups 30:60:120

# Then restart:
sudo systemctl restart ssh

Attempt the connection:
- From a different ISP or network
- Through a VPN
- Via a bastion/jump host (if available)

If it works through a VPN but not your normal connection, your ISP may be interfering with SSH traffic. Try connecting to a non-standard SSH port (if your server supports it):

ssh -p 2222 user@hostname

Ensure compatibility by running the latest SSH implementations:

# On client (macOS/Linux):
ssh -V

# On server, update OpenSSH:
sudo apt update && sudo apt install openssh-server openssh-client
# or
sudo yum update openssh-clients openssh-server

After updating the server, restart SSH:

sudo systemctl restart ssh

If the server's host key has changed or you're getting conflicting entries:

ssh-keygen -R <server-ip>
ssh-keygen -R <hostname>

Then try connecting again. You will get a prompt to accept the new host key.