What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“Connection closed by remote host” means the SSH server, a gateway, or a security device actively terminated your connection. The fastest fix is to identify the phase where it closes: a message at kex_exchange_identification is a pre-authentication admission problem, while a disconnect after login usually involves keep-alives, NAT, VPN, or load-balancer timeouts. Run the client in verbose mode, match its timestamp and source address in the server logs, then change one setting at a time.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the error actually tells you
SSH is a sequence of stages rather than a single login operation. A TCP connection can succeed, yet the server can still reject the attempt before it presents a host key, during algorithm negotiation, while authenticating the user, when opening a session, or minutes later when an established session becomes idle. The final client line is therefore more useful than the generic phrase itself.
As an Amazon Associate I earn from qualifying purchases.
| Last useful client message or behavior | Likely phase | First place to investigate |
|---|---|---|
kex_exchange_identification: Connection closed by remote host |
Before user authentication | MaxStartups, per-source limits, bans, firewall or IDS rules, access policy, and the gateway path |
| No matching key exchange, MAC, cipher, or host-key algorithm | Protocol negotiation | Client/server versions and their enabled algorithm lists |
| Authentication starts, then the server closes the connection | User authentication | Username, keys, agent identities, authorized_keys, permissions, and authentication limits |
| Login succeeds but the shell or forwarding channel will not open | Session startup or forwarding | Account restrictions, subsystem configuration, gateway forwarding policy, and server logs |
| Session works, then drops after inactivity | Established-session timeout | Client/server keep-alives, NAT, VPN, firewall, and load-balancer idle timers |
A pre-authentication closure cannot be repaired with a keep-alive: no encrypted session exists yet. Conversely, raising MaxStartups will not fix a connection that disconnects after an hour of idle time.
Collect evidence before changing SSH
Use an existing console, out-of-band console, or a second administrator connection before editing or reloading the daemon. A syntax error or an overly broad access rule can lock out every administrator.
- Capture a complete verbose trace. Run
ssh -vvv user@hostand save all output, including the timestamp, destination, and source network. The OpenBSD client manual documents-vas progressively higher-detail diagnostic output; threevflags normally provide enough detail to locate the failing stage. - Record software versions. Run
ssh -Von the client andsshd -Vor check the server package version. OpenSSH behavior and available directives vary by release and distribution. - Check the server at the same time. Depending on the operating system, inspect
journalctl -u sshd,journalctl -u ssh,/var/log/auth.log, or/var/log/secure. Match the exact time and the client’s public source IP. - Classify the final line. Decide whether the failure is at TCP connect, banner/key exchange, authentication, session startup, forwarding, or idle disconnect. Do not treat every “connection closed” line as the same fault.
- Make one evidence-based change. Validate the configuration, reload only after validation, and retry. Record what changed and whether the server log changed; this prevents several simultaneous edits from hiding the cause.
If the log says the connection was refused or timed out rather than closed, investigate routing, listening sockets, firewalls, and DNS separately. “Closed by remote host” means the endpoint accepted enough of the connection to terminate it deliberately, or an intermediary did so on its behalf.
Fix connection bursts and MaxStartups drops
MaxStartups limits simultaneous unauthenticated connections. Attempts beyond the limit are dropped until existing attempts authenticate or their login-grace periods expire. OpenBSD documents the default random-drop form as 10:30:100: up to 10 unauthenticated connections are accepted, then new attempts are increasingly dropped, reaching a full drop rate at 100. A verbose trace or server log that says Exceeded MaxStartups identifies this cause.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchReduce pressure first
- Stop or throttle parallel deployment jobs, health checks, backup scripts, and connection scanners that open many SSH sessions at once.
- Reuse connections for trusted automation where appropriate instead of starting a new handshake for every command.
- Restrict internet exposure with firewall rules, source allow-lists, or rate controls so random scans do not consume unauthenticated slots.
- Check whether slow authentication, an overloaded host, or a long login grace period leaves half-open attempts occupying slots.
Only after measuring legitimate concurrency should you consider increasing MaxStartups. A larger value consumes more resources and can make a password-guessing burst easier to sustain. Size it for the real number of simultaneous unauthenticated clients, not for an arbitrary large number, and monitor again after the change.
Check per-source limits, penalties, and bans
Global capacity can be healthy while one address is rejected. PerSourceMaxStartups adds a limit for unauthenticated connections from a single source. Newer OpenSSH configurations can also use PerSourcePenalties to temporarily refuse a source after events such as invalid-user attempts or failed authentication.
Trace the source address through every enforcement layer
- Inspect Fail2Ban jails and the OpenSSH filter for a ban on the client’s public address.
- Check nftables or iptables sets and chains, cloud security-group rules, and any upstream intrusion-detection or abuse-prevention system.
- Verify that a NAT gateway is not making many unrelated users appear as one source address.
- Compare a test from a different, authorized network. If only one public address fails, a source-specific control is more likely than a server-wide outage.
The Fail2Ban OpenSSH filter recognizes several pre-authentication patterns, including Connection closed by remote host, resets, invalid users, authentication failures, and algorithm-negotiation failures. Confirm the event in logs before unbanning an address. Remove the ban only after fixing the underlying cause, and do not disable protection globally as a first response.
Resolve Allow/Deny policy and effective configuration
SSH access can be rejected even when the network and credentials are correct. Review AllowUsers, DenyUsers, AllowGroups, and DenyGroups in the main configuration and any included files. A matching deny rule blocks access; for the same user, DenyUsers takes precedence over AllowUsers.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Validate safely
- Edit the intended configuration file and inspect included fragments for a later rule that changes the result.
- Run
sshd -t. This checks syntax and host-key validity without starting a second daemon. - Run
sshd -Tto print the daemon’s effective settings rather than relying on what a file appears to say. - If conditional
Matchblocks apply, add connection context, for examplesshd -T -C user=alice,addr=203.0.113.20,laddr=192.0.2.10,host=server.example. Use the actual user, client address, local address, and host name for the failed attempt. - Reload the service only after the test succeeds, keeping the existing administrative session open.
After a reload, repeat the connection with -vvv and compare the server log. An access rule should produce a corresponding policy or authorization message; if the log still reports a capacity or ban event, continue with that path instead.
Separate jump-host and forwarding failures
With ProxyJump, a bastion, or another tunnel, there are two SSH paths: your client to the gateway and the gateway to the destination. The gateway can reject forwarding even when the destination is healthy. For example, an AllowTcpForwarding no policy prevents the forwarding channel required by many jump configurations.
- Connect to the gateway directly with
ssh -vvv gateway-user@gateway. - Inspect the gateway’s SSH log for the same timestamp and source address.
- Test the destination directly when policy and network design permit it. A successful direct connection isolates the problem to the gateway or tunnel.
- Check the destination log separately; a failure on the second leg may be invisible in the client’s first-leg output.
- Review forwarding directives, account restrictions, and any gateway-specific allow-list before changing destination settings.
Do not open broad forwarding permissions merely to make a test pass. Grant only the forwarding mode and accounts required by the jump design.
Rank #4
- Standard size: 4 pink server note pads, Each Book Comes with 50 bound order slips - that's 200 ticket sheets total! Check Pads Size 6.75 x 3.5 inch.
- Convenient Work: These guest check books for servers have a tear-free dotted line that is easy to rip off. You can give as a customer copy or keep for record keeping. We've provided extra rows on the back for additional note taking.Perfect For Restaurants, Lounges, Hotels, Cafes, And Waiters To Use.
- Record Important Information: These server note pads can record important information.Each ticket has a unique serial number printed at the top, dates, order details, number of guests, order amount, table numbers etc. They are lightweight, small and can fit most aprons. They can be used on-demand and can help decrease errors in orders, while improving work efficiency.
- High Quality: Sturdy, Not Drop Powder, It's Thick, You Can Write On The Back And Front Easily.Their whole page printing has clear handwriting and a reasonable layout. On the customer retention part of each guest check, "THANK YOU" on the back to make customers feel appreciated.
- Contact Us: We're confident that the quality of the server note pads will go beyond your expectation. If you experience an issue, contact us, we'll appreciate it to learn from your experience, and we'll make it better
Handle protocol and algorithm mismatches
Verbose output that reports no matching key exchange, MAC, cipher, or host-key algorithm indicates incompatible protocol settings, not a password problem. Compare the client and server versions and list what each supports with commands such as ssh -Q kex, ssh -Q mac, ssh -Q cipher, and ssh -Q key.
Preferred and temporary remedies
- Upgrade the obsolete endpoint or install a current OpenSSH package when possible.
- Re-enable a modern algorithm on the server and client rather than weakening both sides broadly.
- If a legacy host cannot yet be upgraded, apply a compatibility option to one host entry or one command only. Document the exception and remove it after the upgrade.
- Never copy a random algorithm string from an old forum post; confirm that the running client lists it and that the server’s policy permits it.
Algorithm failures normally appear before user authentication. If the trace reaches public-key or password authentication, negotiation has already succeeded and another section applies.
Distinguish host-key warnings from identity and credential errors
The client stores server host keys in ~/.ssh/known_hosts. When a host identity changes, SSH warns because the connection could be intercepted or the server may have been rebuilt. A host-key warning is not permission to delete the file blindly.
- Verify the new host key through a trusted out-of-band channel, such as the server console, an approved inventory record, or an administrator who can read the host’s key fingerprint.
- Only after verification, remove the specific old entry with
ssh-keygen -R host(include the correct name or address if you connect using more than one). - Retry and confirm that the newly presented fingerprint matches the verified value.
If the server accepts the host key and reaches authentication, check that the username is correct, the intended private key is being offered, the agent contains the expected identity, and the matching public key exists in the account’s authorized_keys. Check ownership and restrictive permissions on the home directory, .ssh, and authorized_keys. A credential failure generally produces an authentication message rather than an immediate kex_exchange_identification closure.
Fix sessions that connect and then drop
A session that logs in successfully and later disappears follows a different path from a pre-auth closure. The server’s ClientAliveInterval controls encrypted probes sent to the client; ClientAliveCountMax controls how many unanswered probes are tolerated. OpenBSD documents defaults of ClientAliveInterval 0 and ClientAliveCountMax 3. With an interval of 15 seconds and the default count of 3, an unresponsive client can be disconnected after approximately 45 seconds.
Keep the path active without masking a network fault
- For an idle or frozen path, try a narrowly scoped client setting such as
ServerAliveInterval 120in the relevant host entry or command. This sends client-side probes every 120 seconds; it does not repair a server that is rejecting new handshakes. - Inspect firewall, NAT, VPN, and load-balancer idle timers. Set their timeout above the keep-alive interval when policy allows.
- Check server logs for broken pipes, timed-out channels, or explicit keep-alive failures at the disconnect time.
- Test an active session and an idle session separately. If only idle sessions fail, focus on timers rather than authentication or
MaxStartups.
Keep-alives generate traffic and can keep a dead network path appearing alive for longer, so use a value appropriate to the environment rather than setting an extremely short interval.
Use version and distribution details to avoid wrong fixes
Record both client and server versions before comparing directives. OpenSSH 10.4/10.4p1 was released on 2026-07-06; its release notes include changes affecting connection limits, penalties, and keep-alive handling. A directive or default described for that release may not exist or behave identically on an older distribution package.
Service names and log locations also vary: one system may use ssh, another sshd; authentication events may be in the system journal, /var/log/auth.log, or /var/log/secure. Trust the target host’s sshd -T output and local sshd_config(5) manual for the settings actually in force.
| Directive or setting | Documented default or role | When it matters |
|---|---|---|
MaxStartups |
10:30:100 random-drop form |
Concurrent unauthenticated connection bursts |
MaxAuthTries |
6 | Repeated authentication attempts within one connection |
MaxSessions |
10 | Multiple sessions or channels over one authenticated connection |
ClientAliveInterval |
0 | Server-side encrypted keep-alive probes; zero disables them |
ClientAliveCountMax |
3 | Unanswered server probes tolerated before disconnect |
These are published OpenBSD defaults, not universal values. A distribution, administrator, included configuration file, or conditional Match block can override them.
Quick Recap
A practical decision path
- Fails before authentication with
kex_exchange_identification: check the matching log entry, then investigateMaxStartups,PerSourceMaxStartups, penalties, bans, firewall/IDS controls, and access policy. - Fails with “no matching” algorithm text: inventory supported algorithms and versions; upgrade first and scope any temporary compatibility setting to one host.
- Fails only through a bastion: test the gateway directly, inspect both logs, and verify forwarding policy.
- Fails after a host-key change: verify the fingerprint out of band, then remove only the specific stale entry.
- Reaches authentication: verify username, offered identities,
authorized_keys, permissions, and authentication limits. - Logs in but drops while idle: inspect keep-alive settings and network idle timers; test with a client
ServerAliveIntervalappropriate to the path. - Every client fails: prioritize daemon configuration, host resources, service status, and global firewall changes. Only one source fails: prioritize source bans, per-source limits, NAT identity, and that client’s route.
Final safety checklist
- Keep a working console or second administrator session open.
- Save the complete
ssh -vvvtrace and the corresponding server-log lines. - Record the client/server versions, source IP, destination, and whether a gateway is involved.
- Run
sshd -tbefore reloading and usesshd -Tto confirm effective settings. - Change one cause-related setting at a time, then retry and compare evidence.
- Remove temporary legacy-algorithm exceptions and temporary diagnostic access after the connection is repaired.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
