sshd log full of "Did not receive identification string from "

Some miscreant (surprise!) is hammering at ssh to try to find a username/password combination that gets them into the system. Probably from some botnet doing the same to who knows how many other unsuspecting victims.

Install something like fail2ban or DenyHosts (some of both should be available for any Linux distribution), or set up your local firewall to limit SSH connection attempts. Changing the SSH port makes the dumb brute force tries fail, but it also makes legitimate uses fail.


Actually, this was from my hosting provider - they spam my VPS every 6 seconds, to show my server status on their web console. My server is displayed as active if my sshd answers them.

I just installed OpenVPN and allowed SSH only via that - so, according to my providers my server boasts 100% downtime.


This is most likely a keepalive (verifying the server is responding) from a comm. device.


Such messages are thrown by SSH when someone tried to access it but did not finish the steps. For example if NMS is checking whether port ssh 22 is up or not, it will simply try to connect on port 22 and if the connection is successful, it will hang up, in such cases SSH reports the same.

So it is because of an SSH port scan.


Try changing the ssh port from 22 to another one in sshd_config:

sudo nano /etc/ssh/sshd_config

If it doesn't stop messages, the issue can also be caused by this: Freebpx causes sshd errors in /var/log/secure log file or see discussion here "Did not receive identification string" in auth.log on Ubuntu forums.