I use putty to ssh into a couple of hosts. All these hosts allow both public key authentication and password authentication. I was able to login to these hosts previously, but suddenly for some of them I get "Network error: Software caused connection abort" shortly after I attempt to log in.
I tried to log ssh packets and this is the last lines of log file when I try to use my private key to login:
Event Log: Sent public key signature
Incoming packet #0x6, type 52 / 0x34 (SSH2_MSG_USERAUTH_SUCCESS)
Event Log: Access granted
Event Log: Opening session as main channel
Outgoing packet #0x7, type 90 / 0x5a (SSH2_MSG_CHANNEL_OPEN)
[some raw data]
And the when I try to use password:
Event Log: Sent password
Incoming packet #0x6, type 52 / 0x34 (SSH2_MSG_USERAUTH_SUCCESS)
Event Log: Access granted
Event Log: Opening session as main channel
Outgoing packet #0x8, type 90 / 0x5a (SSH2_MSG_CHANNEL_OPEN)
[some raw data]
I also tried plink -v
and this is the last lines of the output:
When using public key:
Sent public key signature
Access granted
Opening session as main channel
When using password:
Sent password
Access granted
Opening session as main channel
All of these result in Network error: Software caused connection abort.
I can log in to these hosts using ssh command that comes with git bash (OpenSSH_7.6p1, OpenSSL 1.0.2n) without any problems. I am also able to log in to some other hosts using putty.
I did all these tests on same computer and same network.
How can I find the cause of this problem?
I use putty 0.70. These are log records from server which I'm pretty sure are related to some of my failed login attempts, and maybe it's worth noting that I am the only one who has access to this host, so these data are related to activity of a single user:
04:42:46 static sshd[14329]: pam_unix(sshd:session): session opened for user root by (uid=0)
04:43:36 static sshd[14335]: Accepted password for root from [my-ip-address] port 1111 ssh2
04:43:36 static sshd[14335]: pam_unix(sshd:session): session opened for user root by (uid=0)
04:48:11 static sshd[14335]: Received disconnect from [my-ip-address] port 1111:11: disconnected by user
04:48:11 static sshd[14335]: Disconnected from [my-ip-address] port 1111
04:48:11 static sshd[14335]: pam_unix(sshd:session): session closed for user root
04:48:15 static sshd[14365]: Accepted password for root from [my-ip-address] port 1125 ssh2
04:48:15 static sshd[14365]: pam_unix(sshd:session): session opened for user root by (uid=0)
04:52:25 static sshd[14365]: Received disconnect from [my-ip-address] port 1125:11: disconnected by user
04:52:25 static sshd[14365]: Disconnected from [my-ip-address] port 1125
04:52:25 static sshd[14365]: pam_unix(sshd:session): session closed for user root
04:52:29 static sshd[14404]: Accepted password for root from [my-ip-address] port 1135 ssh2
04:52:29 static sshd[14404]: pam_unix(sshd:session): session opened for user root by (uid=0)
04:58:39 static sshd[14324]: pam_unix(sshd:session): session closed for user root
04:59:17 static sshd[14404]: pam_unix(sshd:session): session closed for user root
04:59:43 static sshd[14329]: pam_unix(sshd:session): session closed for user root
I can see according to timestamps my sessions overlapped, but on my side all my log in attempts resulted in error.
I updated putty to 0.71 and I could connect to the host using the exact same settings. Also, when using version 0.70 on another network, I could successfully log in to the host.
Although I managed to log in to the host, my question still stands and I'd appreciate if someone could tell me how I can investigate the root cause of the problem.
"Access granted"
does not provide much information to go on. The associated lines in the Linux host syslog (or systemd journal) would be helpful, along with the windows version and version of PuTTY used."session opened for user root"
? Are you trying to login atroot
?sshd
by default does not allowroot
login. That is bad practice (except in limited cases across a LAN to manage package repositories, etc..). Login as your normal user and if you then need to becomeroot
configuresudo
andsu
to allow it for your user only. Look at thePermitRootLogin
option in/etc/ssh/sshd_config
on the server.sshd
begin limiting the number of connection allowed at once via theMaxStartups
option. This should not impact a single login from PuTTY, but if you have multiple connections being established at once, it is something to check. There also seems to be a ~ 5 min. (300 sec) difference betweensession opened for user root
andDisconnected from
. It is almost like you are not seeing the login on PuTTY, but the connection is active, then something like aServerAliveInterval
is tripped and your session closed? That's all I have.