SSH to Codeberg gives "connection closed by remote host" immediately #2672

Comment

Hello,

The CodeBerg SSH server appears to block right away. Debug shows it disconnects immediately, suggesting IP based blocking.

I am behind CGNAT, so little control over my IP address.

Very new on CodeBerg, never had issues on GitHub with SSH, any pointers would be much appreciated.

Thanks,
teeay

debug1: kex_exchange_identification: banner line 0: Not allowed at this time
kex_exchange_identification: Connection closed by remote host
Connection closed by 217.197.84.140 port 22

I'm having the same problem.

I saw this in the morning, thought it was my VPN, disconnected, verified my ssh key

I can confirm ssh git@codeberg.org worked even with VPN but pushing to repo was failing for me

Edit: I tried again with and without and now its just failing

I get intermittent disconnections via SSH, but after a few retries it always succeeds. Seems to coincide with #2596 rather than any IP blocking

Hi, we've seen a larger number of SSH attempts, at a certain threshold sshd decide to start dropping them to prevent a DoS - unfortunately that protection itself a is DoS vector as you've noticed. We already limit the amount of concurrent SSH connections and we've now upped this threshold to simply let sshd deal with these new number of unauthenticated SSH before dropping new connections as that does more harm than waiting on a SSH connection that will never authenticate.

Thanks @Gusted

SSH is just my preference for convenience, but understand it's a lot heavier than the connectionless HTTP path.

Would HTTP be preferable for the CodeBerg infrastructure?

There's no preference from Codeberg's side. SSH isn't that heavy compared with what TLS 1.3 does. It's possible we disable this openssh feature and limit connections via HAProxy.

It seems connections are being dropped again, the feature from sshd is now disabled that does this. Rate limiting is now done differently with a queue.

Thank you, @Gusted , this is now working on my end.
Appreciate your help in this.

Getting a similar result (closed connection), even after validating my key. Works without vpn, but not with.