Picture this: you’re in the middle of a deployment, and suddenly your SSH connection refuses to connect. The server returns a Too Many Authentication Failures error like:
Received disconnect from host: 2: Too many authentication failures for root
You have entered the correct password. You have the correct SSH key. Nothing appears to be wrong with your credentials, yet the connection keeps failing. This error can be confusing because “Too many authentication failures” doesn’t necessarily mean that you entered the wrong password too many times.
One of the most common causes is that your SSH client is offering multiple identities, often from your SSH agent, before it gets to the correct key. The server reaches its MaxAuthTries limit and closes the connection before successful authentication can occur.
In this guide, we will explain why this happens, how to diagnose the exact cause, and several ways to fix it, from the quickest command-line solution to a permanent SSH configuration. We will also cover how to prevent the problem in CI/CD environments and some additional SSH security practices.
Let’s dig in.
TL;DR
- A common cause of “Too many authentication failures” is that the SSH client offers multiple identities before successful authentication.
- OpenSSH’s MaxAuthTries controls how many authentication attempts are permitted per connection. Its default is commonly 6.
- Having many keys loaded into ssh-agent does not automatically mean there is a problem. The important question is which identities SSH actually offers during the connection.
- Quick fix: Specify the correct key and use IdentitiesOnly=yes:
ssh -o IdentitiesOnly=yes -i ~/.ssh/your_specific_key user@hostname
- Recommended long-term fix: Configure IdentitiesOnly yes and IdentityFile for the host in ~/.ssh/config.
- Increasing MaxAuthTries can be useful in specific environments, but it should generally be a last resort.
- For automation and CI/CD, explicitly specify the intended SSH identity instead of allowing the client to try multiple keys.
SSH Client
│
├── Work Key
├── GitHub Key
├── AWS Key
├── Old Key
└── Correct Server Key
│
▼
SSH Server
│
MaxAuthTries = 6
│
▼
Too many authentication failures
What Does “Too Many Authentication Failures” Actually Mean?
The error message can make it sound like you’ve simply entered an incorrect password too many times. That’s not necessarily what happened.
A common scenario looks like this:
- Your SSH client has multiple identities available.
- Some of those identities may come from ssh-agent.
- SSH offers identities to the server during authentication.
- The server rejects identities that aren’t authorized for the target account.
- The number of authentication attempts reaches the server’s MaxAuthTries limit.
- The server terminates the connection before the correct identity is successfully used.
OpenSSH’s MaxAuthTries setting controls the maximum number of authentication attempts permitted per connection. The default is commonly 6. The exact value can be changed by the server administrator.
You can refer to the OpenSSH sshd_config documentation for the current behavior and default values.
For example, imagine your SSH agent contains several keys:
work-key
github-key
aws-key
old-project-key
personal-key
server-key
Your intended server-key may be valid for the destination server, but if SSH offers several other identities first, the server may reach its authentication-attempt limit before the correct key gets a chance to authenticate.
This is why you can have a perfectly valid SSH key and still receive:
Too many authentication failures
Important clarification: Having more than six keys in your SSH agent does not automatically mean you will get this error.
The important thing is how many authentication attempts are actually made during the connection and how your SSH client and server are configured.
That’s why checking the verbose SSH output is important before changing server-side settings.
Why this matters for your fix: Most quick fixes just tell you to specify the key with -i. That’s not wrong, but it’s incomplete. The real fix is telling SSH to stop offering other keys entirely, which is what IdentitiesOnly yes does.
How SSH Agent Can Contribute to the Problem
An SSH agent such as ssh-agent can store multiple private-key identities so you don’t have to repeatedly enter passphrases.
You can check which keys are currently loaded with:
ssh-add -l
You might see something like:
256 SHA256:xxxx work-key (ED25519)
256 SHA256:xxxx github-key (ED25519)
256 SHA256:xxxx aws-key (ED25519)
256 SHA256:xxxx old-project-key (ED25519)
256 SHA256:xxxx personal-key (ED25519)
Having multiple keys isn’t inherently bad. The problem occurs when SSH offers identities that aren’t appropriate for the target server and consumes the server’s available authentication attempts before the correct identity succeeds.
This is one reason IdentitiesOnly yes is so useful. It allows you to tell SSH to use only the identity I explicitly configured for this host.
OpenSSH documents IdentitiesOnly specifically for situations where ssh-agent offers multiple identities.
Read Full Article: https://serveravatar.com/fix-too-many-authentication-failures-ssh
