DEV Community

chen zong
chen zong

Posted on Originally published at termai.sh

Fixing SSH "Too many authentication failures" (and why it happens)

#ssh #linux #tutorial

Originally published on termai.sh.

What the error actually means

The server cut you off because your client made too many auth attempts in one connection — by default OpenSSH allows 6 (MaxAuthTries). The counterintuitive part: you usually see this without doing anything wrong. The cause is almost always a client with many keys loaded: it offers key 1, key 2, key 3… each rejection counts as a failure, and you're disconnected before the right key ever gets a turn.

Why your client offers every key it has

SSH agents accumulate keys: everything in ~/.ssh, everything added to ssh-agent, keys from other servers. By default the client tries them all, in order. Five wrong keys = five failures = one attempt left. People with 6+ keys get rejected by every new server, which looks baffling until you know the mechanism.

Fix 1 — Offer only the right key (desktop) 

# one-off: force a single key, ignore the agent's pile
ssh -o IdentitiesOnly=yes -i ~/.ssh/the_right_key user@host
Enter fullscreen mode Exit fullscreen mode

Make it permanent per-host in ~/.ssh/config:

Host myserver
    HostName 203.0.113.7
    User deploy
    IdentityFile ~/.ssh/the_right_key
    IdentitiesOnly yes
Enter fullscreen mode Exit fullscreen mode

IdentitiesOnly yes is the key directive: it stops the client from parading every agent key past the server.

Fix 2 — On mobile, pin the key to the connection

Mobile clients are naturally less prone to this — but only if the connection is configured with one specific key. Attach the key that belongs to this server to the connection, and the client offers exactly that one, so the failure counter never piles up.

Fix 3 — Server-side (use sparingly) 

MaxAuthTries 10
# then: sudo systemctl restart ssh
Enter fullscreen mode Exit fullscreen mode

Treat this as a workaround, not the fix — a higher limit also gives brute-forcers more swings per connection (fail2ban mitigates that). The real fix is clients offering the right key first. With password auth, repeatedly mistyping also trips the limit — that one is just retyping carefully or switching to keys.

TL;DR

  • Meaning: too many auth attempts in one connection (default cap 6, MaxAuthTries)
  • Real cause: the client/agent offering its whole key pile, wrong ones first
  • Fix: IdentitiesOnly yes + the one right IdentityFile; on mobile, pin the key per connection
  • Avoid: raising MaxAuthTries as a workaround — it widens the brute-force window

Full version with the FAQ: SSH "Too many authentication failures".

Top comments (0)