How to fix Connection reset by hostname port XXXXX [preauth] in SSH

Run "tail -f /var/log/auth.log" or "journalctl -u sshd -f" on the server to monitor incoming connections and identify if the resets correlate with brute-force attempts or legitimate clients.

Look for patterns:
- Multiple failed password attempts from the same IP
- "Connection reset" entries in rapid succession
- Specific client IPs consistently triggering the error

Stop the running SSH server and run it in debug mode to capture detailed connection information:

sudo systemctl stop sshd
sudo sshd -dd

In another terminal, attempt a connection:

ssh -vvv user@target-host

Debug output will show exactly where the connection breaks (key exchange, authentication, etc.). Stop with Ctrl+C when done.

Restart SSH normally:

sudo systemctl start sshd

Edit /etc/ssh/sshd_config and ensure essential options are configured:

sudo nano /etc/ssh/sshd_config

Key settings to check:
- LoginGraceTime 120 (grace period for auth before reset)
- MaxAuthTries 6 (max failed attempts)
- PubkeyAuthentication yes (enable key auth)
- PasswordAuthentication yes (enable password auth, if needed)
- AuthorizedKeysFile .ssh/authorized_keys (correct path)

After editing, validate the config:

sudo sshd -t

If valid, restart SSH:

sudo systemctl restart sshd

Slow DNS or GSSAPI authentication can timeout during preauth. Edit /etc/ssh/sshd_config:

GSSAPIAuthentication no
UseDNS no

These settings prevent the server from performing reverse DNS lookups or attempting Kerberos authentication, both of which can cause timeouts.

Validate and restart:

sudo sshd -t && sudo systemctl restart sshd

If logs show repeated "Connection reset" from specific IPs, install and configure fail2ban to block attackers:

sudo apt-get install fail2ban
sudo systemctl start fail2ban

Create /etc/fail2ban/jail.local:

[sshd]
enabled = true
port = ssh
logpath = /var/log/auth.log
maxretry = 5
findtime = 600
bantime = 3600

Restart fail2ban:

sudo systemctl restart fail2ban

View currently banned IPs:

sudo fail2ban-client status sshd

Use tcpdump to inspect the actual network traffic:

sudo tcpdump -i eth0 -n host <client-ip> and port 22

Attempt a connection from the client and examine the output. Look for:
- SYN/SYN-ACK/ACK handshake (should succeed)
- RST packets with "no window, length or ip.id set" (indicates faulty hardware)
- Normal TLS/SSH handshake followed by immediate RST (indicates server issue)

If RST packets appear anomalous, the problem is likely faulty network hardware (switch, firewall). Contact network administrator to replace or reconfigure the hardware.