openssh bugs - Jan 2025 - [Bug 3777] New: error: kex_exchange_identification: Connection closed by remote host

https://bugzilla.mindrot.org/show_bug.cgi?id=3777

            Bug ID: 3777
           Summary: error: kex_exchange_identification: Connection closed
                    by remote host
           Product: Portable OpenSSH
           Version: 9.2p1
          Hardware: amd64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: jvishwanath66 at gmail.com

The following error log has been continuously reported in
/var/log/auth.log

Dec 31 04:50:08 devnode-host sshd[19205]: error:
kex_exchange_identification: Connection closed by remote host
Dec 31 04:50:08 devnode-host sshd[19205]: Connection closed by
10.203.0.4 port 45196
Dec 31 04:50:21 devnode-host sshd[19277]: error:
kex_exchange_identification: Connection closed by remote host
Dec 31 04:50:21 devnode-host sshd[19277]: Connection closed by
10.203.0.4 port 45258
Dec 31 04:50:33 devnode-host sshd[19385]: error:
kex_exchange_identification: Connection closed by remote host
Dec 31 04:50:33 devnode-host sshd[19385]: Connection closed by
10.203.0.4 port 45294
Dec 31 04:50:44 devnode-host sshd[19458]: error:
kex_exchange_identification: Connection closed by remote host
Dec 31 04:50:44 devnode-host sshd[19458]: Connection closed by
10.203.0.4 port 45332
Dec 31 04:50:56 devnode-host sshd[19558]: error:
kex_exchange_identification: Connection closed by remote host
Dec 31 04:50:56 devnode-host sshd[19558]: Connection closed by
10.203.0.4 port 45374

OS:
Debian 12.8

Kernel: 
6.6.68

List of SSH Packages
/home/admin# dpkg -l | grep "ssh"
ii  libssh2-1:amd64                1.10.0-3+b1                         
  amd64        SSH2 client-side library
ii  openssh-client                 1:9.2p1-2+deb12u3                   
  amd64        secure shell (SSH) client, for secure access to remote
machines
ii  openssh-server                 1:9.2p1-2+deb12u3                   
  amd64        secure shell (SSH) server, for secure access from remote
machines
ii  openssh-sftp-server            1:9.2p1-2+deb12u3                   
  amd64        secure shell (SSH) sftp server module, for SFTP access
from remote machines
ii  python3-paramiko               2.12.0-2                            
  all          Make ssh v2 connections (Python 3)
ii  ssh                            1:9.2p1-2+deb12u3                   
  all          secure shell client and server (metapackage)

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3777

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at dtucker.net

--- Comment #1 from Darren Tucker <dtucker at dtucker.net> ---
That looks like whatever is on 10.203.0.4 is connecting to port 22 then
immediately closing the connection.  What's on that machine?  The
behaviour looks like a port scan or similar.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3777

--- Comment #2 from Vishwanath Jadhav <jvishwanath66 at gmail.com> ---
Hi Darren Tucker,
Thank you for the quick reply.
The IP 10.203.0.4 is belongs to our firewall

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3777

--- Comment #3 from Darren Tucker <dtucker at dtucker.net> ---
(In reply to Vishwanath Jadhav from comment #2)
> Hi Darren Tucker,
> Thank you for the quick reply.
> The IP 10.203.0.4 is belongs to our firewall
Then I suspect either something behind it is conducting a port scan, or
perhaps there's a problem such as a Path MTU bug causing a legitimate
client behind it fail to complete a connection and ultimately send a
TCP RST.  You would need to break out tcpdump or similar and
investigate.

Either way absent evidence to the contrary it seems like this is
behaving as intended.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3777

--- Comment #4 from Vishwanath Jadhav <jvishwanath66 at gmail.com> ---
Darren Tucker,

Thanks for the details, I will close this card.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3777

Vishwanath Jadhav <jvishwanath66 at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |INVALID
             Status|NEW                         |RESOLVED

--- Comment #5 from Vishwanath Jadhav <jvishwanath66 at gmail.com> ---
The error message is showing the expected behavior, hence marking it
Resolved/Invalid.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.