SSH rate limits
🚦
Too many, too fast.
fortrabbit limits SSH and SFTP connections per IP address. Above 40 connections at once or 100 new ones a minute, or after repeated failed logins, the address is blocked for a few minutes. The error message tells which limit applies.
About SSH rate limits
The SSH endpoint limits connections per IP address, to block brute-force logins and runaway clients:
| Per IP address | Slowed down | Rejected | Dropped |
|---|---|---|---|
| Concurrent connections | above 20 | above 40 | above 80 |
| New connections a minute | above 20 | above 100 | above 200 |
Repeated logins with a wrong key also block the address for a while. The cause is often a program in the background, such as a database GUI that opens a new tunnel per tab, or an SFTP plugin in the IDE.
The limits lift a few minutes after the traffic stops. A client stuck in a loop keeps the address blocked until it is stopped. fortrabbit does not allowlist customer IP addresses.
Identify a rate limit
A rate limit is likely when the same connection worked before, and unlikely when SSH never worked. To check, connect from another network, for example through a phone hotspot, or read the output of the ssh command line client.
Too many connections
The server answers with a banner instead of an SSH greeting:
$ ssh {{app-env-id}}@ssh.{{region}}.frbit.app
Bad remote protocol version identification: 'SSH-Restricted_TooManyConcurrentConnections'
banner exchange: Connection to X.X.X.X port 22: invalid format
With -v, the banner shows the reason and the numbers:
$ ssh {{app-env-id}}@ssh.{{region}}.frbit.app -v
...
debug1: Local version string SSH-2.0-OpenSSH_10.0
debug1: kex_exchange_identification: banner line 0:
debug1: kex_exchange_identification: banner line 1: ******************************************************
debug1: kex_exchange_identification: banner line 2: SSH connection rejected due to overusage!
debug1: kex_exchange_identification: banner line 3:
debug1: kex_exchange_identification: banner line 4: Reason: TooManyConcurrentConnections
debug1: kex_exchange_identification: banner line 5: Active: 41 concurrent connections (limit: 40)
debug1: kex_exchange_identification: banner line 6: Rate: 10 connections per minute (limit: 100)
debug1: kex_exchange_identification: banner line 7: Client IP: Y.Y.Y.Y
debug1: kex_exchange_identification: banner line 8: ******************************************************
debug1: kex_exchange_identification: banner line 9:
Bad remote protocol version identification: 'SSH-Restricted_TooManyConcurrentConnections'
banner exchange: Connection to X.X.X.X port 22: invalid format
The block lifts once the connections drop below the limits.
Connection closed
The server closes the connection right away, without a banner. The address is blocked after too many failed logins.
$ ssh {{app-env-id}}@ssh.{{region}}.frbit.app
Connection closed by X.X.X.X port 22
Stop all connection attempts for a few minutes, and the block lifts.
Permission denied
The address is not blocked, but the key is wrong. Check the SSH keys:
$ ssh {{app-env-id}}@ssh.{{region}}.frbit.app
Permission denied (publickey).