When many users connect simultaneously, you might see connections dropped:

bash
$ ssh user@server
ssh_exchange_identification: Connection closed by remote host

Or in server logs:

bash
sshd[12345]: drop connection: MaxStartups exceeded
sshd[12345]: Connection from 192.168.1.50 dropped by MaxStartups

SSH uses MaxStartups to throttle connection attempts, preventing overwhelming the server.

Understand MaxStartups

The MaxStartups setting controls concurrent unauthenticated connections. When too many people try to connect at once, SSH randomly drops new connections to protect itself.

Format: start:rate:full

  • start - Number of connections accepted without throttling
  • rate - Percentage chance of dropping when between start and full
  • full - Maximum connections before rejecting all

Default: 10:30:100

Example behavior with default: - 0-10 connections: All accepted - 10-100 connections: Increasingly likely to drop (30% at midpoint) - Over 100: All new connections rejected

Diagnose the Problem

Check server logs:

bash
sudo journalctl -u sshd -f
sudo tail -f /var/log/auth.log | grep MaxStartups

Or:

bash
sudo tail -f /var/log/secure | grep -i startup

Look for:

bash
Apr  3 10:15:22 server sshd[12345]: drop connection #15 from 192.168.1.50 port 22: MaxStartups 10:30:100

Check Current MaxStartups

On the server:

bash
sudo grep MaxStartups /etc/ssh/sshd_config

If commented or missing, default is 10:30:100.

Increase MaxStartups

Edit SSH configuration:

bash
sudo nano /etc/ssh/sshd_config

For servers with many concurrent users:

bash
MaxStartups 50:30:200

For high-traffic automation servers:

bash
MaxStartups 100:30:500

For maximum acceptance (no throttling until very high):

bash
MaxStartups 100:10:1000

Apply:

bash
sudo sshd -t
sudo systemctl restart sshd

Monitor Connection Attempts

Count pending connections:

bash
ss -tn | grep :22 | grep -v ESTAB | wc -l

Watch connections in real-time:

bash
watch -n 1 'ss -tn | grep :22 | wc -l'

Check Authentication Speed

Slow authentication causes connections to pile up. Check what's slowing it:

bash
sudo grep UseDNS /etc/ssh/sshd_config

Disable DNS lookups:

bash
sudo sed -i 's/^UseDNS.*/UseDNS no/' /etc/ssh/sshd_config

Check GSSAPI:

bash
sudo grep GSSAPIAuthentication /etc/ssh/sshd_config

Disable if not needed:

bash
sudo sed -i 's/^GSSAPIAuthentication.*/GSSAPIAuthentication no/' /etc/ssh/sshd_config

Handle Burst Connections

For CI/CD or batch processing, stagger connections:

bash
# In scripts, add delays
for server in ${servers[@]}; do
    sleep 0.5
    ssh user@$server 'command' &
done
wait

Use connection multiplexing to reduce new connections:

bash
# ~/.ssh/config
Host *
    ControlMaster auto
    ControlPath ~/.ssh/sockets/%r@%h-%p
    ControlPersist 600

Check LoginGraceTime

Authentication timeout affects pending connections:

bash
sudo grep LoginGraceTime /etc/ssh/sshd_config

Default is 60 seconds. If authentication takes longer, reduce it:

bash
LoginGraceTime 30

This disconnects slow authenticators faster, freeing slots.

Test Connection Capacity

Simulate many connections:

bash
for i in {1..50}; do
    timeout 5 ssh -o BatchMode=yes user@server 'hostname' &
done
wait

Monitor for dropped connections.

Balance MaxStartups and MaxSessions

Both settings matter: - MaxStartups - Limits concurrent unauthenticated connections - MaxSessions - Limits sessions per authenticated connection

Example balanced config:

bash
MaxStartups 50:30:100
MaxSessions 10

Use Load Balancer for High Traffic

For extreme concurrent users, use a load balancer:

bash
# HAProxy config
listen ssh_cluster
    bind *:22
    mode tcp
    balance leastconn
    option tcplog
    server ssh1 10.0.1.1:22 check
    server ssh2 10.0.1.2:22 check

Check System Limits

SSH connections consume resources:

```bash # Check file descriptors cat /proc/$(pgrep -o sshd)/limits | grep "open files"

# Check max processes cat /proc/$(pgrep -o sshd)/limits | grep "Max processes" ```

Increase limits in /etc/security/limits.conf:

bash
root soft nofile 65536
root hard nofile 65536

Resolution Checklist

  1. 1.Check MaxStartups value: grep MaxStartups /etc/ssh/sshd_config
  2. 2.Increase MaxStartups for high traffic
  3. 3.Disable slow authentication features (UseDNS, GSSAPI)
  4. 4.Adjust LoginGraceTime for faster cleanup
  5. 5.Use connection multiplexing to reduce new connections
  6. 6.Stagger burst connections in scripts
  7. 7.Monitor connection counts: ss -tn | grep :22
  8. 8.Check system resource limits

MaxStartups protects servers from connection floods. Increase it for busy servers or use connection management to reduce concurrent connection attempts.