Logs/Alerts - error: kex_exchange_identification: client sent invalid protocol identifier

[Michael Kimling]

Hello, everyone.

Trying to track down an alert I started receiving recently. I was configuring Veeam to send backup jobs to my server, and I started receiving this alert message daily:

FreeNAS @ (SERVERNAME)
New alert:
* 23 SSH login failures:
Jul 27 00:08:08 (SERVERNAME) sshd[62185]: error: kex_exchange_identification: client sent invalid protocol identifier " "
Jul 27 01:13:12 (SERVERNAME) sshd[63135]: error: kex_exchange_identification: client sent invalid protocol identifier " "
… 19 more …
Jul 27 22:54:36 (SERVERNAME) sshd[82076]: error: kex_exchange_identification: client sent invalid protocol identifier " "
Jul 27 23:59:41 (SERVERNAME) sshd[82988]: error: kex_exchange_identification: client sent invalid protocol identifier " "

Searching through other similar sshd forum posts, everyone seems to be able to get a log entry with an IP address attached to it to help track down the offender. I have uninstalled my Veeam test configuration, but these alerts are still generating, so I'm at a loss as to what device might be causing this problem. It's basically on an hourly cadence, so some automated process is trying to log in via SSH here.

Where would I find a log message that records the source of my bad SSH requests, or how would I increase the logging detail to capture this information?

Thanks for the help.

Show : See My freeNAS system

OS Version: FreeNAS-11.3-U5
Model: SuperMicro Server
CPU: Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
Memory: 64 GiB
Pool: POOL-36x12TB, RAIDZ2, 4 Vdevs

 

[Michael Kimling]

Apologies for the bump thread here, but I've still been able to find nothing that can help me track down this issue.

There has to be a way to get a source from these errors logged, and I just can't figure out how to do it.

Any help or guidance would be greatly appreciated.

 

[Michael Kimling]

Reading online, I saw a recommendation to go into the Debug Kernel to try to identify "something".

I was really grasping at straws to find some info, and ended up needed to take a trip to my datacenter after Debug Kernel dropped all external connectivity.

The one positive out of all of that is the multiple reboots of my environment stopped the SSH errors. I can only surmise that there being no Source IP in my log, and the reboot solving my problem, that the server itself was trying to SSH into itself?

Something for people who are smarter than I to try to make sense of. Hopefully this thread at least serves as a reference to anyone else who may run across the same problem.