Skip to main content
protocols.pageprotocols.page
1

SSH_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT

DisconnectRFC 4253 §11.1

SSH_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT (1) is sent when the server refuses the connection because the client host is not permitted to connect. The server has an allow-list or deny-list that excludes this client's IP address or hostname. Defined in RFC 4253 §11.1.

Code

1

Category

Disconnect

Standard

RFC 4253 §11.1

Description

This disconnect code is sent immediately after the TCP connection is established and before any authentication, when the server has determined the connecting host is not permitted. Servers implementing IP-based access control (hosts.allow, AllowHosts in sshd_config, or firewall rules that still permit TCP but deny at the SSH layer) use this code.

In OpenSSH, the AllowUsers and DenyUsers directives can trigger this when the source address portion of user@host patterns matches. The client receives this disconnect before being able to attempt any authentication.

Distinguishing this from a firewall RST: a firewall drops or resets the TCP connection with no ICMP or TCP-level response. Code 1 means the SSH server itself accepted the TCP connection but then immediately rejected it at the SSH protocol layer.

Common Causes

  • –Client IP not in sshd_config AllowUsers host pattern
  • –Client IP in DenyHosts or fail2ban blocklist
  • –TCP wrappers (hosts.deny) configured to block this source
  • –SSH server configured with explicit host-based access control lists
RFC 4253 – SSH specification →