5.3. Gateway Messages

During the different phases of connection establishment, key-exchange, authentication and the end of a session, the gateway could get in a situation where it has to disconnect the client. When this situation arises, the suSSHi Gateway sends a DISCONNECT message to the client and, if there is already a connection to a target server, to the target server as well containing a reason code and a message.

All clients (at least the default ones and all the ones tested by us) will display this message together with the reason code after getting a DISCONNECT from the gateway. Some clients will also display a human readable text for each corresponding reason code.

5.3.1. RFC-defined Codes

Please find below the predefined DISCONNECT reason codes of SSH protocol version 2:

Reason Code	Meaning (as defined)
1	DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT
2	DISCONNECT_PROTOCOL_ERROR
3	DISCONNECT_KEY_EXCHANGE_FAILED
4	DISCONNECT_HOST_AUTHENTICATION_FAILED
5	DISCONNECT_MAC_ERROR
6	DISCONNECT_COMPRESSION_ERROR
7	DISCONNECT_SERVICE_NOT_AVAILABLE
8	DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED
9	DISCONNECT_HOST_KEY_NOT_VERIFIABLE
10	DISCONNECT_CONNECTION_LOST
11	DISCONNECT_BY_APPLICATION
12	DISCONNECT_TOO_MANY_CONNECTIONS
13	DISCONNECT_AUTH_CANCELLED_BY_USER
14	DISCONNECT_NO_MORE_AUTH_METHODS_AVAIL
15	DISCONNECT_ILLEGAL_USER_NAME

The message code varies from type to type and will inform the user about what happened.

5.3.2. Gateway Messages

The following listings cover all authentication, authorization and connection messages a user may see.

Note

By default, suSSHi Gateway sends concise disconnect messages that reveal minimal detail about the reason. More descriptive messages can be enabled with the Verbose disconnect messages setting in the partition settings in suSSHi Chef. We recommend enabling verbose messages only in non-internet-facing environments, as detailed error output may help an attacker probe the system.

5.3.2.1. Client related

Status Code	Message / Description
4001	Authentication failed - invalid username
	The username string was provided in wrong format.
4002	Authentication failed - invalid username
	The username string contains illegal characters.
4003	Invalid port given. Please try again
	The Target TCP port is outside the permitted range.
4011	Authentication failed
	Authentication failed for some reason.
4012	Authentication failed
	During an agent auth phase, the auth agent sent an invalid signature.
4013	Client responds with no identities from SSH agent
	Client does not send any identities (keys) for SSH Agent authentication.
4014	Too many authentication failures. Please come back later.
	The user has tried to authenticate with wrong credentials more than 5 times.
4031	Access denied
	The user is not allowed to connect to target.
4032	Access denied
	The user is not allowed to run an interactive session on target.
4033	Access denied
	The user is not allowed to execute a command (exec request) on target.
4034	Access denied
	The target is on the list of denied targets for this partition.
4035	Access denied
	Subsystem request is not allowed.
4051	Target requires keyboard-interactive authentication to be allowed on client. Please activate keyboard-interactive authentication and reconnect
	The target server requires keyboard-interactive authentication, but the client has not enabled it.
4052	Authentication failed. Authentication agent missing or unreachable
	The policy requires SSH agent authentication, but the client has not forwarded an SSH agent. Connect with agent forwarding enabled (e.g. the -A flag in OpenSSH).
4053	No session requested. Authentication agent mode is not working without interactive session or remote command.
	The policy requires SSH agent authentication, but the client did not request an interactive shell or command execution session (e.g. the -N flag was used).

5.3.2.2. Target related

Status Code	Message / Description
4081	Failed to connect to target
	The gateway could not establish a connection to the target server.
4091	Target host key could not be verified
	The target server’s host key does not match the fingerprint stored in suSSHi Chef.
5002	Protocol error
	There is a SSH protocol error that could not be resolved.
5003	Service not available
	The requested service is not available.
5004	Service not available
	User requested Gateway bastion mode without specifying a proxy target, which is not supported.
5021	Connection lost
	The connection to the client or the target was lost unexpectedly.
5022	Failed to connect to target proxy gateway. Please check availability of the proxy gateway for specified realm
	The specified proxy realm is unknown or the proxy gateway is unreachable.
5023	The suSSHi Proxy server runs on an older version, that does not support the suSSHi Bastion feature.
	The suSSHi Proxy server runs on an older version, that does not support the suSSHi Bastion feature. Please contact the administrator of the suSSHi Proxy server to update it to a newer version.
5024	The suSSHi Proxy failed to start Bastion feature.
	The suSSHi Proxy failed to start Bastion feature. Please contact the administrator of the suSSHi Proxy server to check health.
5031	Protocol error
	The Gateway could not talk to the target as expected.
5032	Failed to resolve target hostname
	The Gateway could not resolve the target hostname.
5033	Failed to resolve target hostname - resolved address family not configured on gateway
	Failed to resolve target hostname - resolved address family not configured on gateway
5041	Failed to connect to target proxy gateway. Please check availability of the proxy gateway for specified realm
	The Gateway could not connect to the Target proxy gateway for the specified realm.
5042	Failed to connect to target proxy gateway. Please check availability of the proxy gateway for specified realm
	The Gateway could not login to the Target proxy gateway for the specified realm. A wrong configuration of the Target proxy gateway is very likely.

5.3.2.3. Fatal messages

Status Code	Message / Description
5001	Internal Server Error
	The Gateway or suSSHi Chef is suffering from an internal error.
9001	Something went wrong
	An unexpected internal condition occurred that could not be mapped to a specific error.