11

No matter on which server I try to connect via password login, I always get the error message

 Too many authentication failures for

If I have exchanged the ssh-keys, I can login without password as before, also if I rename my user ~/.ssh folder, I get to the password prompt as suspected.

What can I have wrong in my .ssh folder?

If I run ssh-add -l this list is > 5

So I have more than 5 keys in my ssh-agent and it seem to insist on looping through all my keys in my agent (with none of them fitting, cause I didnt create a key for this server) before reaching max_tries.

I also read this: SSH aborts with too many authentication failures

But I couldn't find the solution there, (maybe because of lack of understanding).

The only way to login for me is to call ssh with the option PreferredAuthentications=password: 

ssh -o PreferredAuthentications=password host.example.org

But that is just a workaround. How can I fix this?

Improve this question
2
  • David gave you the correct answer below. IdentityFile is how you tell SSH which key you want to use.
    – Bryan Geraghty
    Commented Aug 12, 2014 at 16:35
  • Try running 'sshd -d -d -d' and 'ssh -v -v -v', that should give you far more information about what is going on.
    – Jeff-Inventor ChromeOS
    Commented Aug 13, 2014 at 8:25

2 Answers 2

Reset to default
11

Add this in your ~/.ssh/config: 

Host *
   IdentitiesOnly yes

source: How do I configure SSH so it dosen't try all the identity files automatically?

Improve this answer
5

  1. You can set the preferred authentication method in the ~/.ssh/config file for the server(s) you are trying to access.

    Host <hostname>
    PreferredAuthentications password

  2. You can set the IdentityFile parameter for other servers you are connecting to in the ~/.ssh/config so you'll both connect to them more quickly and avoid the risk of too many failed authentication attempts.

    Host <hostname>
    IdentityFile ~/.ssh/my_key.pem

You can use the config file to set up aliases to your hosts as well, using the HostName parameter (and the host will be the nickname).
In the answers to the question you posted a link to, one of the parameters used is the IdentitiesOnly, which ignores the list in the ssh-agent.

You can use wildcards as well (mainly *) to work with all other servers, be sure to put the wildcard entry last and set the preferred authentication for the publickey hosts since ssh uses a first match algorithm.

man on ssh_config will show you the options you can use.

Improve this answer
5
  • But I have only those 6 servers I have keys to. All others and all new servers I want password authentication.
    – rubo77
    Commented Aug 13, 2014 at 5:53
  • Edited to include wildcards.
    – Didi Kohen
    Commented Aug 13, 2014 at 6:57
  • 1
    I think this is the solution: Host * new line IdentitiesOnly yes source: How do I configure SSH so it dosen't try all the identity files automatically?
    – rubo77
    Commented Aug 13, 2014 at 11:50
  • You can’t do this if you actually want to use your ssh-agent. (The keys are not on this machine!)
    – Robert Siemer
    Commented Jan 9, 2015 at 18:38
  • @RobertSiemer correct, if you want to use the ssh-agent this option will not work for you. If you post a new question with the details of what you're trying to do I'll do my best to help you. (please link it here so I'll be aware of it)
    – Didi Kohen
    Commented Jan 15, 2015 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .