[GH-ISSUE #2999] 开启frp后，系统日志出现大量重复的SSH连接报错

gitea-mirror commented

2026-05-05 13:32:34 -06:00

Owner

Originally created by @Biohacking6141 on GitHub (Jul 1, 2022).
Original GitHub issue: https://github.com/fatedier/frp/issues/2999

Bug Description

一旦开启frp后，系统日志每隔4-5秒出现一条ssh连接报错。

frpc Version

0.43.0

frps Version

0.43.0

System Architecture

linux/amd64

Configurations

frpc.ini

[common]
server_addr = X.X.X.X
server_port = 7001
token = 1234

[ssh]
type = tcp
local_ip = 127.0.0.1
local_port = 22
remote_port = 6001

frps.ini

[common]
bind_port = 7001
token = 1234

Logs

Jul 01 15:02:03 test sshd[589898]: Unable to negotiate with 127.0.0.1 port 60948: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jul 01 15:02:07 test sshd[589900]: Unable to negotiate with 127.0.0.1 port 60950: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jul 01 15:02:11 test sshd[589902]: Unable to negotiate with 127.0.0.1 port 60952: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Jul 01 15:02:14 test sshd[589904]: Unable to negotiate with 127.0.0.1 port 60954: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]

Steps to reproduce

...

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @Biohacking6141 on GitHub (Jul 1, 2022). Original GitHub issue: https://github.com/fatedier/frp/issues/2999 ### Bug Description 一旦开启frp后，系统日志每隔4-5秒出现一条ssh连接报错。 ### frpc Version 0.43.0 ### frps Version 0.43.0 ### System Architecture linux/amd64 ### Configurations frpc.ini ``` [common] server_addr = X.X.X.X server_port = 7001 token = 1234 [ssh] type = tcp local_ip = 127.0.0.1 local_port = 22 remote_port = 6001 ``` frps.ini ``` [common] bind_port = 7001 token = 1234 ``` ### Logs Jul 01 15:02:03 test sshd[589898]: Unable to negotiate with 127.0.0.1 port 60948: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth] Jul 01 15:02:07 test sshd[589900]: Unable to negotiate with 127.0.0.1 port 60950: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth] Jul 01 15:02:11 test sshd[589902]: Unable to negotiate with 127.0.0.1 port 60952: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth] Jul 01 15:02:14 test sshd[589904]: Unable to negotiate with 127.0.0.1 port 60954: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth] ### Steps to reproduce 1. 2. 3. ... ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [ ] Security - [X] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror

2026-05-05 13:32:34 -06:00

closed this issue
added the
lifecycle/stale
label

gitea-mirror commented

2026-05-05 13:32:37 -06:00

Author

Owner

@Becods commented on GitHub (Jul 1, 2022):

恶意爆破，尝试更换其他端口或换用stcp

@Becods commented on GitHub (Jul 1, 2022): 恶意爆破，尝试更换其他端口或换用stcp

gitea-mirror commented

2026-05-05 13:32:38 -06:00

Author

Owner

@Biohacking6141 commented on GitHub (Jul 27, 2022):

恶意爆破，尝试更换其他端口或换用stcp
又出现大量新的报错，关掉frpc服务后就好了。

Jul 14 08:27:53 test sshd[519133]: pam_unix(sshd:auth): check pass; user unknown
Jul 14 08:27:53 test sshd[519133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1
Jul 14 08:27:53 test sshd[519131]: Failed password for invalid user ij from 127.0.0.1 port 48924 ssh2
Jul 14 08:27:55 test sshd[519133]: Failed password for invalid user ij from 127.0.0.1 port 48926 ssh2
Jul 14 08:27:56 test sshd[519129]: Connection closed by invalid user ij 127.0.0.1 port 48922 [preauth]
Jul 14 08:27:56 test sshd[519129]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1
Jul 14 08:27:57 test sshd[519131]: pam_unix(sshd:auth): check pass; user unknown
Jul 14 08:27:59 test sshd[519133]: pam_unix(sshd:auth): check pass; user unknown
Jul 14 08:27:59 test sshd[519131]: Failed password for invalid user ij from 127.0.0.1 port 48924 ssh2
Jul 14 08:28:01 test sshd[519135]: Invalid user ij from 127.0.0.1 port 48928

@Biohacking6141 commented on GitHub (Jul 27, 2022): > 恶意爆破，尝试更换其他端口或换用stcp 又出现大量新的报错，关掉frpc服务后就好了。 > Jul 14 08:27:53 test sshd[519133]: pam_unix(sshd:auth): check pass; user unknown > Jul 14 08:27:53 test sshd[519133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 > Jul 14 08:27:53 test sshd[519131]: Failed password for invalid user ij from 127.0.0.1 port 48924 ssh2 > Jul 14 08:27:55 test sshd[519133]: Failed password for invalid user ij from 127.0.0.1 port 48926 ssh2 > Jul 14 08:27:56 test sshd[519129]: Connection closed by invalid user ij 127.0.0.1 port 48922 [preauth] > Jul 14 08:27:56 test sshd[519129]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 > Jul 14 08:27:57 test sshd[519131]: pam_unix(sshd:auth): check pass; user unknown > Jul 14 08:27:59 test sshd[519133]: pam_unix(sshd:auth): check pass; user unknown > Jul 14 08:27:59 test sshd[519131]: Failed password for invalid user ij from 127.0.0.1 port 48924 ssh2 > Jul 14 08:28:01 test sshd[519135]: Invalid user ij from 127.0.0.1 port 48928

gitea-mirror commented

2026-05-05 13:32:38 -06:00

Author

Owner

@github-actions[bot] commented on GitHub (Aug 26, 2022):

Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

@github-actions[bot] commented on GitHub (Aug 26, 2022): Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.