8

No matter on which server I try to connect via password login, I always get the error message

Too many authentication failures for

If I have exchanged the ssh-keys, I can login without password as before, also if I rename my user ~/.ssh folder, I get to the password prompt as suspected.

What can I have wrong in my .ssh folder?

If I run ssh-add -l this list is > 5

So I have more than 5 keys in my ssh-agent and it seem to insist on looping through all my keys in my agent (whith none of them fitting, cause I didnt create a key for this server) before reaching max_tries.

I also read this: SSH aborts with Too many authentication failures

But I couldn't find the solution there, (maybe because of lack of understanding)

The only way to login for me is to call ssh with the option PreferredAuthentications=password:

ssh -o PreferredAuthentications=password host.example.org

But that is just a workaround. How can I fix this?

  • David gave you the correct answer below. IdentityFile is how you tell SSH which key you want to use. – Bryan Geraghty Aug 12 '14 at 16:35
  • Try running 'sshd -d -d -d' and 'ssh -v -v -v', that should give you far more information about what is going on. – Jeff-Inventor ChromeOS Aug 13 '14 at 8:25
9

Add this in your ~/.ssh/config:

Host *
   IdentitiesOnly yes

source: How do I configure SSH so it dosen't try all the identity files automatically?

5
  1. You can set the preferred authentication method in the ~/.ssh/config file for the server(s) you are trying to access.

    Host <hostname>
    PreferredAuthentications password

  2. You can set the IdentityFile parameter for other servers you are connecting to in the ~/.ssh/config so you'll both connect to them more quickly and avoid the risk of too many failed authentication attempts.

    Host <hostname>
    IdentityFile ~/.ssh/my_key.pem

You can use the config file to set up aliases to your hosts as well, using the HostName parameter (and the host will be the nickname).
In the answers to the question you posted a link to, one of the parameters used is the IdentitiesOnly, which ignores the list in the ssh-agent.

You can use wildcards as well (mainly *) to work with all other servers, be sure to put the wildcard entry last and set the preferred authentication for the publickey hosts since ssh uses a first match algorithm.

man on ssh_config will show you the options you can use.

  • But I have only those 6 servers I have keys to. All others and all new servers I want password authentication. – rubo77 Aug 13 '14 at 5:53
  • Edited to include wildcards. – Didi Kohen Aug 13 '14 at 6:57
  • 1
    I think this is the solution: Host * new line IdentitiesOnly yes source: How do I configure SSH so it dosen't try all the identity files automatically? – rubo77 Aug 13 '14 at 11:50
  • You can’t do this if you actually want to use your ssh-agent. (The keys are not on this machine!) – Robert Siemer Jan 9 '15 at 18:38
  • @RobertSiemer correct, if you want to use the ssh-agent this option will not work for you. If you post a new question with the details of what you're trying to do I'll do my best to help you. (please link it here so I'll be aware of it) – Didi Kohen Jan 15 '15 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.