ssh: Connection reset by peer

[Tom H]

Hi,

I have a couple of RHEL4 which have started disconnecting me during ssh 
login after I enter the correct password;

"Read from remote host msweb01.test.ms.osti.local: Connection reset by peer
Connection to msweb01.test.ms.osti.local closed."

I turned on -vvv debugging on the client and the relevant section is;

debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
txxxxxx at msweb01.test.ms.osti.local's password:
debug3: packet_send2: adding 48 (len 61 padlen 19 extra_pad 64)
debug2: we sent a password packet, wait for reply
debug1: Authentication succeeded (password).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug1: Entering interactive session.
debug1: channel 0: free: client-session, nchannels 1
debug3: channel 0: status: The following connections are open:
  #0 client-session (t3 r-1 i0/0 o0/0 fd 4/5 cfd -1)

debug3: channel 0: close_fds r 4 w 5 e 6 c -1
Read from remote host msweb01.test.ms.osti.local: Connection reset by peer
Connection to msweb01.test.ms.osti.local closed.
debug1: Transferred: stdin 0, stdout 0, stderr 126 bytes in 0.2 seconds
debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 703.9
debug1: Exit status -1


A tcpdump shows that the server is sending a RST, ACK to close the 
connection. The server debug logs has the following;


Apr 27 04:08:24 msweb01 sshd[13481]: debug2: monitor_read: 46 used once, 
disabling now
Apr 27 04:08:24 msweb01 sshd[13481]: debug2: monitor_read: 3 used once, 
disabling now
Apr 27 04:08:24 msweb01 sshd[13481]: debug2: monitor_read: 4 used once, 
disabling now
Apr 27 04:08:24 msweb01 sshd[13481]: debug2: monitor_read: 9 used once, 
disabling now
Apr 27 03:08:24 msweb01 sshd[13482]: debug1: userauth_banner: sent
Apr 27 03:08:24 msweb01 sshd[13482]: Failed none for txxxxxx from 
10.127.5.104 port 4460 ssh2
Apr 27 03:08:27 msweb01 sshd[13482]: debug1: userauth-request for user 
txxxxxx service ssh-connection method password
Apr 27 03:08:27 msweb01 sshd[13482]: debug1: attempt 1 failures 1
Apr 27 03:08:27 msweb01 sshd[13482]: debug2: input_userauth_request: try 
method password
Apr 27 04:08:27 msweb01 sshd[13481]: debug1: PAM: password 
authentication accepted for txxxxxx
Apr 27 04:08:27 msweb01 sshd[13481]: Accepted password for txxxxxx from 
10.127.5.104 port 4460 ssh2
Apr 27 03:08:27 msweb01 sshd[13482]: Accepted password for txxxxxx from 
10.127.5.104 port 4460 ssh2
Apr 27 04:08:27 msweb01 sshd[13481]: debug1: monitor_child_preauth: 
txxxxxx has been authenticated by privileged process
Apr 27 04:08:27 msweb01 sshd[13481]: debug2: mac_init: found hmac-md5
Apr 27 04:08:27 msweb01 sshd[13481]: debug2: mac_init: found hmac-md5
Apr 27 04:08:27 msweb01 sshd[13481]: debug2: User child is on pid 13484
Apr 27 04:08:27 msweb01 sshd[13481]: debug1: do_cleanup
Apr 27 04:08:27 msweb01 sshd[13481]: debug1: PAM: cleanup



Any ideas on what might cause that?

Thanks,

Tom