0

I use putty to ssh into a couple of hosts. All these hosts allow both public key authentication and password authentication. I was able to login to these hosts previously, but suddenly for some of them I get "Network error: Software caused connection abort" shortly after I attempt to log in.
I tried to log ssh packets and this is the last lines of log file when I try to use my private key to login:

Event Log: Sent public key signature
Incoming packet #0x6, type 52 / 0x34 (SSH2_MSG_USERAUTH_SUCCESS)
Event Log: Access granted
Event Log: Opening session as main channel
Outgoing packet #0x7, type 90 / 0x5a (SSH2_MSG_CHANNEL_OPEN)
  [some raw data]

And the when I try to use password:

Event Log: Sent password
Incoming packet #0x6, type 52 / 0x34 (SSH2_MSG_USERAUTH_SUCCESS)
Event Log: Access granted
Event Log: Opening session as main channel
Outgoing packet #0x8, type 90 / 0x5a (SSH2_MSG_CHANNEL_OPEN)
  [some raw data]

I also tried plink -v and this is the last lines of the output:

When using public key:

Sent public key signature
Access granted
Opening session as main channel

When using password:

Sent password
Access granted
Opening session as main channel

All of these result in Network error: Software caused connection abort.

I can log in to these hosts using ssh command that comes with git bash (OpenSSH_7.6p1, OpenSSL 1.0.2n) without any problems. I am also able to log in to some other hosts using putty.

I did all these tests on same computer and same network.

How can I find the cause of this problem?

I use putty 0.70. These are log records from server which I'm pretty sure are related to some of my failed login attempts, and maybe it's worth noting that I am the only one who has access to this host, so these data are related to activity of a single user:

04:42:46 static sshd[14329]: pam_unix(sshd:session): session opened for user root by (uid=0)
04:43:36 static sshd[14335]: Accepted password for root from [my-ip-address] port 1111 ssh2
04:43:36 static sshd[14335]: pam_unix(sshd:session): session opened for user root by (uid=0)
04:48:11 static sshd[14335]: Received disconnect from [my-ip-address] port 1111:11: disconnected by user
04:48:11 static sshd[14335]: Disconnected from [my-ip-address] port 1111
04:48:11 static sshd[14335]: pam_unix(sshd:session): session closed for user root
04:48:15 static sshd[14365]: Accepted password for root from [my-ip-address] port 1125 ssh2
04:48:15 static sshd[14365]: pam_unix(sshd:session): session opened for user root by (uid=0)
04:52:25 static sshd[14365]: Received disconnect from [my-ip-address] port 1125:11: disconnected by user
04:52:25 static sshd[14365]: Disconnected from [my-ip-address] port 1125
04:52:25 static sshd[14365]: pam_unix(sshd:session): session closed for user root
04:52:29 static sshd[14404]: Accepted password for root from [my-ip-address] port 1135 ssh2
04:52:29 static sshd[14404]: pam_unix(sshd:session): session opened for user root by (uid=0)
04:58:39 static sshd[14324]: pam_unix(sshd:session): session closed for user root
04:59:17 static sshd[14404]: pam_unix(sshd:session): session closed for user root
04:59:43 static sshd[14329]: pam_unix(sshd:session): session closed for user root

I can see according to timestamps my sessions overlapped, but on my side all my log in attempts resulted in error.
I updated putty to 0.71 and I could connect to the host using the exact same settings. Also, when using version 0.70 on another network, I could successfully log in to the host.

Although I managed to log in to the host, my question still stands and I'd appreciate if someone could tell me how I can investigate the root cause of the problem.

6
  • Note, simply showing the result of the ssh negotiation and "Access granted" does not provide much information to go on. The associated lines in the Linux host syslog (or systemd journal) would be helpful, along with the windows version and version of PuTTY used. May 18, 2019 at 6:28
  • @DavidC.Rankin Thanks. I updated the question and added some lines of server log file that I'm confident are related to my failed login attempts.
    – nima
    May 18, 2019 at 13:42
  • What? "session opened for user root"? Are you trying to login at root? sshd by default does not allow root login. That is bad practice (except in limited cases across a LAN to manage package repositories, etc..). Login as your normal user and if you then need to become root configure sudo and su to allow it for your user only. Look at the PermitRootLogin option in /etc/ssh/sshd_config on the server. May 18, 2019 at 21:37
  • As far as my experience goes, most distributions allow root login by default and you have to disable it yourself. I'm aware of the points in your comment, but this was a freshly created virtual machine and this was my very first log in attempt before creating a new user, etc. I can log in to this host as root using other ssh clients, so I'm sure root log in is enabled. But I have the same problem with other hosts using both root and normal user logins.
    – nima
    May 19, 2019 at 5:02
  • The only other thing I can think of, is recently sshd begin limiting the number of connection allowed at once via the MaxStartups option. This should not impact a single login from PuTTY, but if you have multiple connections being established at once, it is something to check. There also seems to be a ~ 5 min. (300 sec) difference between session opened for user root and Disconnected from. It is almost like you are not seeing the login on PuTTY, but the connection is active, then something like a ServerAliveInterval is tripped and your session closed? That's all I have. May 19, 2019 at 7:42

0

You must log in to answer this question.

Browse other questions tagged .