How to fix Received disconnect from host: 2: Too many authentication failures in SSH

Use the -i flag to tell SSH exactly which key to use, bypassing the agent:

ssh -i ~/.ssh/your_specific_key user@hostname

This prevents SSH from trying multiple keys and exhausting the authentication limit. If this works, the issue is key selection, not the connection itself.

Configure SSH to use only the explicitly specified identity files, not all keys in the agent:

Host your-server.com
    HostName your-server.com
    User username
    IdentityFile ~/.ssh/specific_key
    IdentitiesOnly yes

The IdentitiesOnly yes directive tells SSH to ignore other keys in ssh-agent and use only the configured IdentityFile. This is the cleanest long-term solution.

Remove all loaded keys from your SSH agent and add back only the one you need:

# Clear all keys from agent
ssh-add -D

# Add only the specific key you need
ssh-add ~/.ssh/your_specific_key

Then try SSH again:

ssh user@hostname

This temporarily solves the issue but resets when you restart your system or open a new terminal. Use the ~/.ssh/config approach (step 2) for a permanent fix.

Force SSH to bypass the agent entirely for one connection:

SSH_AUTH_SOCK= ssh -i ~/.ssh/your_key user@hostname

This unsets the SSH_AUTH_SOCK environment variable, preventing SSH from accessing the agent. Useful for troubleshooting when you want to test without agent interference.

If you want to bypass key authentication temporarily and use password instead:

ssh -o PreferredAuthentications=password user@hostname

This is helpful for testing whether the issue is with key authentication or something else. After confirming password auth works, you can focus on fixing the key setup.

See what's currently in your SSH agent:

ssh-add -l

Remove keys you no longer use:

ssh-add -d ~/.ssh/old_key

Or delete the key files entirely if you're certain they're no longer needed:

rm ~/.ssh/old_key ~/.ssh/old_key.pub

Fewer loaded keys means fewer authentication attempts, reducing the chance of hitting the limit.

If you control the SSH server, you can increase the authentication attempt limit in /etc/ssh/sshd_config:

# Edit the SSH daemon config
sudo nano /etc/ssh/sshd_config

Find or add the line:

MaxAuthTries 10

Then restart SSH:

sudo systemctl restart ssh
# or on some systems:
sudo service sshd restart

Warning: Setting MaxAuthTries too high reduces security against brute force attacks. Only increase it if you have a legitimate reason (e.g., systems with many keys in production).

Ensure your private keys have proper permissions (600). Keys with wrong permissions can cause authentication failures:

chmod 600 ~/.ssh/your_key

List and verify:

ls -l ~/.ssh/your_key

Should show: -rw------- 1 user group (permissions 600)

Incorrect permissions are a common cause of SSH auth failures.