Skip to main content
protocols.pageprotocols.page
13

SSH_DISCONNECT_AUTH_CANCELLED_BY_USER

DisconnectRFC 4253 §11.1

SSH_DISCONNECT_AUTH_CANCELLED_BY_USER (13) is sent when the user explicitly cancels an in-progress authentication attempt. The client sends this disconnect to inform the server the user chose to abort authentication rather than complete it. Typically generated when the user presses Ctrl+C during a password or keyboard-interactive prompt.

Code

13

Category

Disconnect

Standard

RFC 4253 §11.1

Description

Authentication cancellation happens at the client side – the user decides not to complete authentication and interrupts the process. The SSH client sends SSH_MSG_DISCONNECT with code 13 to cleanly terminate the connection rather than leaving the server waiting for authentication to complete or time out.

This code appears in server logs as a user-initiated abort. It is distinguishable from authentication failure (which uses different SSH messages within the userauth protocol layer) because it terminates the entire connection rather than just declining an auth method.

Automated SSH tools that time out waiting for user input (e.g., expecting a password prompt but none arrives) may generate this disconnect when the timeout fires and the tool cancels the connection.

Common Causes

  • –User pressed Ctrl+C during password or keyboard-interactive authentication prompt
  • –Authentication timeout fired in an automated tool awaiting user input
  • –SSH client application canceled the connection during auth
RFC 4253 – SSH specification →