ssh: kex_exchange_identification: Connection closed by remote host

TL;DR

The server closed the connection during key exchange: usually MaxStartups throttling under load, a fail2ban or hosts.deny block, or a proxy interfering. Check the server's auth log, raise or tune MaxStartups, and clear any block on your IP. The handshake completes once the server stops dropping you.

Error

ssh: kex_exchange_identification: Connection closed by remote host

Steps

1. Check the server side: look at the auth log on the SSH server around the connection time. Expected: a message about dropped connections, throttling, or denied hosts.
2. Look for MaxStartups throttling: under connection storms sshd drops new connections probabilistically. Expected: the log shows the throttle engaging during bursts.
3. Check fail2ban and TCP wrappers (hosts.deny) for your client IP. Expected: either a block to remove or a clean bill of health.
4. Tune the server: raise MaxStartups for legitimate bursts, or whitelist automation IPs in fail2ban. Expected: the server accepts the connection rate you actually have.
5. Retry the SSH connection, preferably with verbose flags to confirm the handshake passes key exchange. Expected: the session establishes.

When to use

• SSH fails during key exchange with "Connection closed by remote host"
• Bursty automation (CI, config management) hitting one server
• After enabling fail2ban or TCP wrappers

When not to use

• "Permission denied (publickey)" (authentication, later phase)
• Connection timeouts (network, earlier phase)

Tool compatibility

• OpenSSH server (MaxStartups, auth logs); fail2ban, TCP wrappers

Variant phrasings

ssh connection closed during kex

The server dropped you before auth; check throttling and blocks on the server side.

maxstartups drop connections

Raise the limit or stagger the automation so the burst fits.

Why it happens

sshd defends itself: MaxStartups sheds load by dropping connections during bursts, and fail2ban/hosts.deny drop known-bad IPs. Both act during key exchange, before authentication, so the client sees a closed connection with no auth-phase error.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_QSfu6NB0tpDvIOeMquV7-A

Resolved from the public thread: https://vectle.com/posts/pst_QSfu6NB0tpDvIOeMquV7-A

Thread query: ssh: kexexchangeidentification: Connection closed by remote host

TL;DR: The server closed the connection during key exchange: usually MaxStartups throttling under load, a fail2ban or hosts.deny block, or a proxy interfering. Check the server's auth log, raise or tune MaxStartups, and clear any block on your IP. The handshake completes once the server stops dropping you.