Cfrtjryk

I've been trying out Digital Ocean for the last couple of days. I manage to ssh without issues, but after 5-10 minutes, the connection breaks with message: root@my_droplet:~# Connection reset by xxx.xxx.xxx.xxx port 22

As indicated by an answer to another question, I tried to identify the issue by examining log file at /var/log/auth.log. Below, is the log from when I logged in today.

Nov 26 12:07:49 my_droplet sshd[23219]: Accepted publickey for root from xxx.xxx.xxx.xxx port 54365 ssh2: RSA SHA256:[some_key]

Nov 26 12:07:49 my_droplet sshd[23219]: pam_unix(sshd:session): session opened for user root by (uid=0)

Nov 26 12:07:49 my_droplet systemd-logind[756]: New session 921 of user root.

Nov 26 12:10:33 my_droplet sshd[23322]: Accepted publickey for root from xxx.xxx.xxx.xxx port 54374 ssh2: RSA SHA256:[some_key]

Nov 26 12:10:33 my_droplet sshd[23322]: pam_unix(sshd:session): session opened for user root by (uid=0)

Nov 26 12:10:33 my_droplet systemd-logind[756]: New session 922 of user root.

Nov 26 12:10:58 my_droplet sshd[23401]: Invalid user oracle from xxx.xxx.xxx.xxx port 42076

Nov 26 12:10:58 my_droplet sshd[23401]: Received disconnect from xxx.xxx.xxx.xxx port 42076:11: Bye Bye [preauth]

Nov 26 12:10:58 my_droplet sshd[23401]: Disconnected from invalid user oracle xxx.xxx.xxx.xxx port 42076 [preauth]

Nov 26 12:17:01 my_droplet CRON[23405]: pam_unix(cron:session): session opened for user root by (uid=0)

Nov 26 12:17:01 my_droplet CRON[23405]: pam_unix(cron:session): session closed for user root

Nov 26 12:22:34 my_droplet sshd[23409]: Invalid user ttt from xxx.xxx.xxx.xxx port 55188

Nov 26 12:22:34 my_droplet sshd[23409]: Received disconnect from xxx.xxx.xxx.xxx port 55188:11: Bye Bye [preauth]

Nov 26 12:22:34 my_droplet sshd[23409]: Disconnected from invalid user ttt xxx.xxx.xxx.xxx port 55188 [preauth]

Nov 26 12:24:35 my_droplet sshd[23412]: Accepted publickey for root from xxx.xxx.xxx.xxx port 58785 ssh2: RSA SHA256:[some_key]

Nov 26 12:24:35 my_droplet sshd[23412]: pam_unix(sshd:session): session opened for user root by (uid=0)

Nov 26 12:24:35 d3 systemd-logind[756]: New session 924 of user root.

I'm a bit confused by the invalid user messages below (my user is 'root'). Also, the log file suggests that invalid users logs have been made every minute from when the log file starts.

Dont Login as root:

Logging in as root may be convenient however, it is not good in practice.

Seems to me, that when the system trys to do a job as a user other than root, it is acting like root has logged out, or someone is trying to inappropriately change users and kicking you. Like if you execute an application as root from terminal, and you keep the terminal open while the app is running. The things that happen in the application are vissable in the terminal. I believe that something similar to this is happening. Where root must login anouther user to make changes, or a script calls a user other than root to be opened and the connection gets reset.

Create Sudo User:

• If sudo is not installed install it apt-get install sudo




• Create a user on the system useradd someusername , give that user sudo privilages usermod -aG sudo someusername and complete your maintenance tasks that way. So that the user that opened the connetion, has no other duties and need not be released until the connection is closed.

More info here: Digital Ocean: How To Create a Sudo User on Ubuntu

Setup PublickeyAuthentication

On the Client:

• ssh-keygen -t rsa


• ssh-copy-id <HOSTADDRESS>


• Test that the key works.

On the Server:

• edit /etc/ssh/sshd_config so that PublickeyAuthentication yes and PasswordAthentication no only if the key works.


• service ssh restart

More info here: Digital Ocean: SSH Key Based Authentication