SSH "Connection closed by remote host": causes and fixes

What "Connection closed by remote host" means

The server accepted your connection and then deliberately dropped it. That's the key difference from refused (nothing was listening) and timed out (nothing answered at all): here something answered, then hung up. The variants — Connection closed by remote host, Connection reset by peer, kex_exchange_identification: Connection closed by remote host — almost always mean one of: you got banned by fail2ban, the server's sshd is restarting/overloaded, or it hit a connection limit.

The causes, most likely first

1 — The #1 cause: you've been fail2ban'd

If a few failed key/password attempts preceded this, fail2ban (or a cloud provider's equivalent) likely banned your IP — it drops your packets the moment you connect, which surfaces as "closed by remote host." Confirm and clear it from another machine that can still reach the box:

sudo fail2ban-client status sshd          # is your IP listed?
sudo fail2ban-client set sshd unbanip 1.2.3.4

From a phone this is especially common: changing IPs (Wi-Fi to cellular) plus a couple of wrong key attempts is enough to trip a ban. Fixing the underlying auth problem (see Permission denied) stops it recurring.

2 — sshd restarting, rebooting, or overloaded

If the box was rebooting or sshd was reloading config, connections in that window get closed; try again in a minute. On a chronically busy server, sshd's MaxStartups throttle (default 10:30:100) starts dropping unauthenticated connections once too many are in flight — you'll see intermittent closes under load. Raising it on the server helps:

# /etc/ssh/sshd_config
MaxStartups 30:50:100
# then: sudo systemctl reload ssh

3 — Look at the server's own logs

The definitive answer is on the server. From any working access (console, another session):

sudo journalctl -u ssh -n 50      # or: tail -n 50 /var/log/auth.log

It will say plainly whether it's a ban, a refused user, hosts.deny, or a config error — turning guesswork into a one-line diagnosis.

Recovering from a phone

The frustrating part on mobile is you often can't SSH in to investigate the box that just closed on you. If another machine on that network is reachable, hop through it to run the fail2ban-client / journalctl checks. And if you're staring at the raw error unsure which of the five causes it is, select it and ask the assistant — TermAI's AI reads the actual message and your context and tells you whether it smells like a ban, a throttle, or a restart, with the command to confirm.

FAQ

What causes "Connection closed by remote host"?
The server accepted then dropped the connection — most often a fail2ban IP ban, sshd restarting/overloaded, a connection limit (MaxStartups), or host-based blocking. Check the server's auth log.

How is it different from connection refused?
Refused = nothing was listening. Closed by remote host = something answered, then deliberately hung up.

I keep getting banned — why?
Repeated failed auth (often a wrong or unoffered key) trips fail2ban. Fix the auth problem itself, and whitelist your stable address if you have one.

What is kex_exchange_identification: Connection closed?
Same family — the server closed the connection during the initial handshake, typically a ban, throttle, or a non-SSH service on that port.

Quick Facts

• Meaning: the server accepted then deliberately closed the connection (not refused, not timed out)
• #1 cause: fail2ban / IP ban after failed logins — fail2ban-client status sshd
• Others: sshd restarting, MaxStartups throttle under load, hosts.deny, wrong port
• Diagnose: journalctl -u ssh / /var/log/auth.log on the server states the reason
• Mobile tip: changing IPs + a couple of bad key tries easily trips a ban — fix the auth cause