How to fix maximum authentication attempts exceeded for user in SSH

SSHINTERMEDIATEMEDIUMUpdated Jan 4, 2026· 1,565 views

This error occurs when SSH clients exceed the server's maximum authentication attempts limit (default: 6). It's a security mechanism to prevent brute-force attacks. Resolve it by specifying the correct key, reducing failed attempts, or increasing MaxAuthTries on the server.

Quick fix

Fixes maximum authentication attempts exceeded for user

ssh-add -l
  1. Identify which key is correct for this server
  2. Specify the identity file explicitly to avoid rejected keys
  3. Configure IdentitiesOnly in your SSH config to limit key attempts
  4. Remove unused keys from ssh-agent to reduce attempts
ssh — error
ssh-add -l
maximum authentication attempts exceeded for user

What this error means

The SSH daemon (sshd) enforces a limit on how many authentication attempts a single connection can make. When a client tries multiple authentication methods or keys and all fail, the server disconnects after reaching the configured limit (MaxAuthTries). Each failed login attempt increments the counter—whether using wrong passwords, incorrect SSH keys, or unsupported authentication methods. Once the limit is reached, the server immediately closes the connection to protect against brute-force attacks. This is a server-side rejection that prevents further attempts from that connection. The client must reconnect to try again.

Typical symptoms

  • SSH connection drops suddenly during login attempts with no further prompts
  • Error message: 'maximum authentication attempts exceeded for user from [IP]' in server logs
  • Unable to authenticate even with the correct credentials
  • Client receives 'Too many authentication failures' after multiple key attempts
  • Happens when ssh-agent has many keys and server rejects them all before reaching the correct one

Common causes

  1. Multiple SSH keys in ssh-agent and none of them are authorized on the server
  2. Wrong password or key file specified, causing multiple failed attempts
  3. ssh-agent trying all available keys automatically, exhausting MaxAuthTries before reaching the correct one
  4. Misconfigured ssh_config with multiple Host entries pointing to same server with wrong keys
  5. Server configured with MaxAuthTries set too low (default is 6, but security policies may reduce it to 3-4)
  6. Brute-force attack attempt from the same IP address

How to fix "maximum authentication attempts exceeded for user"

1Identify which key is correct for this server

First, verify you're using the right SSH key. List all keys in your ssh-agent:

bash
ssh-add -l

If you have many keys, identify which one is authorized on the target server. You may need to check the server's ~/.ssh/authorized_keys file or contact your administrator.

2Specify the identity file explicitly to avoid rejected keys

Instead of letting ssh-agent try all keys, specify the exact key to use:

bash
ssh -i /path/to/correct/private/key username@hostname

This bypasses ssh-agent and avoids wasting authentication attempts on wrong keys.

3Configure IdentitiesOnly in your SSH config to limit key attempts

Edit or create ~/.ssh/config and add:

bash
Host *
    IdentitiesOnly yes
    IdentityFile ~/.ssh/id_ed25519
    IdentityFile ~/.ssh/id_rsa

This tells SSH to only try the listed keys instead of offering every key in ssh-agent. Order them so the correct key is attempted first.

For a specific host:

bash
Host example.com
    IdentitiesOnly yes
    IdentityFile ~/.ssh/server_specific_key
4Remove unused keys from ssh-agent to reduce attempts

If you have many keys, remove the ones you don't need:

bash
# Remove a specific key
ssh-add -d /path/to/key

# Remove all keys
ssh-add -D

Then add back only the keys you actively use:

bash
ssh-add ~/.ssh/id_rsa
ssh-add ~/.ssh/id_ed25519
5Use verbose mode to debug which keys are being tried

Run SSH with verbose output to see which keys are attempted and in what order:

bash
ssh -vvv username@hostname

Look for lines like:

bash
debug1: Trying private key: /home/user/.ssh/id_rsa
debug1: Trying private key: /home/user/.ssh/id_ed25519

This shows you the order keys are tried and which ones are rejected.

6(Server-side) Increase MaxAuthTries if legitimate users have many keys

If you administer the SSH server and legitimate users have multiple keys, you can increase the limit. Edit /etc/ssh/sshd_config:

bash
# Change from default (usually 6) to a higher value
MaxAuthTries 10

Then restart SSH:

bash
sudo systemctl restart sshd
# or
sudo service sshd restart

Warning: Keep this reasonable (4-6 recommended by security standards). Setting it too high increases brute-force attack risk.

Advanced notes

SSH Key Negotiation Ordering: SSH clients typically try keys in this order: keys explicitly specified with -i, keys from ssh_config IdentityFile directives, then keys from ssh-agent. Each attempt counts toward MaxAuthTries, even if a key doesn't exist on the server.

MaxAuthTries vs Fail2Ban: While MaxAuthTries protects a single connection, Fail2Ban (a common intrusion prevention system) blocks IPs making repeated failed login attempts across multiple connections. Both work together: MaxAuthTries stops brute-force attempts on one connection, while Fail2Ban stops repeated attacks from the same IP.

PAM Delay on Linux: On Linux systems with PAM (Pluggable Authentication Modules), failed authentication attempts are intentionally delayed. This makes brute-force attacks ineffective even if MaxAuthTries is bypassed—each attempt takes seconds instead of being instantaneous.

Security Recommendations: CIS Benchmarks recommend setting MaxAuthTries to 4 or less. However, if users have legitimate multiple keys (e.g., different keys for different servers), reducing it too low will cause problems. Balance security with usability.

Frequently asked questions

What does "maximum authentication attempts exceeded for user" mean?
The SSH daemon (sshd) enforces a limit on how many authentication attempts a single connection can make. When a client tries multiple authentication methods or keys and all fail, the server disconnects after reaching the configured limit (MaxAuthTries). Each failed login attempt increments the counter—whether using wrong passwords, incorrect SSH keys, or unsupported authentication methods.
How do I fix "maximum authentication attempts exceeded for user"?
This error occurs when SSH clients exceed the server's maximum authentication attempts limit (default: 6). It's a security mechanism to prevent brute-force attacks. Resolve it by specifying the correct key, reducing failed attempts, or increasing MaxAuthTries on the server.
What causes "maximum authentication attempts exceeded for user"?
Multiple SSH keys in ssh-agent and none of them are authorized on the server Wrong password or key file specified, causing multiple failed attempts ssh-agent trying all available keys automatically, exhausting MaxAuthTries before reaching the correct one
Is the "maximum authentication attempts exceeded for user" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading