Hi, When using Commercial SSH to connect to OpenSSH, it can happen that a user has many keys and this results in a failure to log in due to "Too many authentication failures". The problem is documented at http://www.tartarus.org/~simon/puttydoc/Chapter10.html#10.5 : 10.5 "Server sent disconnect message type 2 (SSH_DISCONNECT_PROTOCOL_ERROR): "Too many authentication failures for root"" This message is produced by an OpenSSH (or Sun SSH) server if it receives more failed authentication attempts than it is willing to tolerate. This can easily happen if you are using Pageant and have a large number of keys loaded into it. This can be worked around on the server by disabling public-key authentication or (for Sun SSH only) by increasing MaxAuthTries in sshd_config. Neither of these is a really satisfactory solution, and we hope to provide a better one in a future version of PuTTY. You might not want to implement a MaxAuthTries, but at least something must be done so that broken clients can connect (and asking the user to remove some keys from their agent is not it IMHO). Thanks!
we just changed the openssh client to try the agent key in order of preference (instead of randomly), but this only helps for openssh clients....
FYI if you still need this, it is a very easy patch to make (grep for AUTH_FAIL_MAX)
Well, yes, and this is what I did, but it's not really a good solution imho. I mean, the fact that Sun implements it, means that Sun thought it was worth implementing, even as a stop-gat measure. Do you think there is a way to get around this error when it's legitimate?
Created attachment 382 [details] Implement MaxAuthTries, patch against OpenBSD. Would something like this be accepted for OpenBSD? If so I'll do the man page for it.
Just need to add MaxAuthTriesLog and man page entries... (after the 3.8.1 release, that is)
Created attachment 623 [details] Add MaxAuthTries and MaxAuthTriesLog, patch against OpenBSD
Target for 3.9
Created attachment 636 [details] Update patch to -current, add to example sshd_config
This has just been added (MaxAuthTries only, not MaxAuthTriesLog), and will be in tomorrow's snapshot and the next major release. Thanks for the report.