5.3. Gateway Messages

During the different phases of connection establishment, key-exchange, authentication and the end of a session, the gateway could get in a situation where it has to disconnect the client. When this situation arises, the suSSHi Gateway sends a DISCONNECT message to the client and, if there is already a connection to a target server, to the target server as well containing a reason code and a message.

All clients (at least the default ones and all the ones tested by us) will display this message together with the reason code after getting a DISCONNECT from the gateway. Some clients will also display a human readable text for each corresponding reason code.

5.3.1. RFC-defined Codes

Please find below the predefined DISCONNECT reason codes of SSH protocol version 2:

Reason Code	Meaning (as defined)
1	DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT
2	DISCONNECT_PROTOCOL_ERROR
3	DISCONNECT_KEY_EXCHANGE_FAILED
4	DISCONNECT_HOST_AUTHENTICATION_FAILED
5	DISCONNECT_MAC_ERROR
6	DISCONNECT_COMPRESSION_ERROR
7	DISCONNECT_SERVICE_NOT_AVAILABLE
8	DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED
9	DISCONNECT_HOST_KEY_NOT_VERIFIABLE
10	DISCONNECT_CONNECTION_LOST
11	DISCONNECT_BY_APPLICATION
12	DISCONNECT_TOO_MANY_CONNECTIONS
13	DISCONNECT_AUTH_CANCELLED_BY_USER
14	DISCONNECT_NO_MORE_AUTH_METHODS_AVAIL
15	DISCONNECT_ILLEGAL_USER_NAME

The message code varies from type to type and will inform the user about what happened.

5.3.2. Gateway Messages

The following listings cover the most important authentication and authorization messages a user may see:

5.3.2.1. Client related

Status Code	Message / Description
4001	Authentication failed - invalid username
	The username string was provided in wrong format.
4002	Authentication failed - invalid username
	The username string contains illegal characters.
4003	Invalid port given. Please try again
	The Target TCP port is outside the permitted range.
4011	Authentication failed
	Authentication failed for some reason.
4012	Authentication failed
	During an agent auth phase, the auth agent sent an invalid signature.
4013	Client responds with no identities from SSH agent
	Client does not send any identities (keys) for SSH Agent authentication.
4014	Too many authentication failures. Please come back later.
	The user has tried to authenticate with wrong credentials more than 5 times.
4031	Access denied
	The user is not allowed to connect to target.
4032	Access denied
	The user is not allowed to run an interactive session on target.
4033	Access denied
	The user is not allowed to execute a command (exec request) on target.
4034	Access denied
	The target is on the list of denied targets for this partition.
4035	Access denied
	Subsystem request is not allowed.

5.3.2.2. Target related

Status Code	Message / Description
5002	Protocol error
	There is a SSH protocol error that could not be resolved.
5003	Service not available
	The requested service is not available.
5004	Service not available
	User requested Gateway bastion mode without specifying a proxy target, which is not supported.
5031	Protocol error
	The Gateway could not talk to the target as expected.
5032	Failed to resolve target hostname
	The Gateway could resolve the target hostname.
5033	Failed to resolve target hostname - resolved address family not configured on gateway
	Failed to resolve target hostname - resolved address family not configured on gateway
5023	The suSSHi Proxy server runs on an older version, that does not support the suSSHi Bastion feature.
	The suSSHi Proxy server runs on an older version, that does not support the suSSHi Bastion feature. Please contact the administrator of the suSSHi Proxy server to update it to a newer version.
5024	The suSSHi Proxy failed to start Bastion feature.
	The suSSHi Proxy failed to start Bastion feature. Please contact the administrator of the suSSHi Proxy server to check health.
5041	Failed to connect to target proxy gateway. Please check availability of the proxy gateway for specified realm
	The Gateway could not connect to the Target proxy gateway for the specified realm.
5042	Failed to connect to target proxy gateway. Please check availability of the proxy gateway for specified realm
	The Gateway could not login to the Target proxy gateway for the specified realm. A wrong configuration of the Target proxy gateway is very likely.

5.3.2.3. Fatal messages

Status Code	Message / Description
5001	Internal Server Error
	The Gateway or suSSHi Chef is suffering from an internal error.
5032	Failed to resolve target hostname
	The Gateway could resolve the target hostname.