SSH_DISCONNECT_ILLEGAL_USER_NAME
SSH_DISCONNECT_ILLEGAL_USER_NAME (15) is sent when the username provided by the client is syntactically invalid. The server rejects the connection before beginning authentication because the username violates system naming rules – invalid characters, too long, or otherwise malformed.
Code
15
Category
Disconnect
Standard
RFC 4253 §11.1
Description
SSH username validation happens at the protocol level before authentication begins. If the username in the SSH_MSG_USERAUTH_REQUEST contains characters that are invalid on the target system (null bytes, control characters, path separators, or excessively long usernames), the server sends disconnect code 15.
This disconnect should not be confused with a valid but non-existent username. A non-existent username is handled within the authentication protocol – the server responds to auth attempts for unknown users with failure messages to prevent username enumeration. Code 15 is strictly for usernames that cannot be valid by definition.
In practice, code 15 is rarely seen with standard SSH clients because they validate username input. It is more likely to appear when testing SSH implementations with fuzz inputs, or when automation tools incorrectly pass environment variables as usernames.
Common Causes
- –Username contains null bytes or control characters
- –Username exceeds the maximum allowed length
- –Username contains path separator characters (/ or \)
- –Automation bug passing malformed string as SSH username