Error: too many concurrent ssh connections | same error, even after disconnecting from the node

[pankajpandey9]

Hi All, need help regarding the below error:

ERROR: ssh: rejected: administratively prohibited (too many concurrent ssh connections for user "[email protected]" (max=5))

We have configured Teleport for max_connections: 5 . For the sixth connection it throws the error (which is fine). However, when I logout of the other active connections, Teleport still throws the same error(ssh: rejected) and doesn't allow to login (UI /tsh).
I need to wait for approx 15 to 30 mins to reconnect to the node. Not sure, if it is some configuration issue or a normal behaviour to keep the connection alive even after disconnecting from the node.

Any advise will be helpful.
Thanks in advance

[deusxanima]

Hi @pankajpandey9 I suspect this may be an issue that was resolved in 7.0.3. We had an issue pre-7.0.3 where the ssh server's internal connection counter wasn't being decremented correctly due to connections appearing open when they weren't while running in IoT mode, which required a full timeout (that's why you're seeing it take 10-15 minutes) instead of being released immediately. If these nodes are in IoT mode and you're running a version that's lower than 7.0.3 this is most likely the case.

[pankajpandey9]

@AHARIC , Thanks for the response and here are the versions for all the binaries. Also, the nodes are running in IoT mode

Client and Server version are at 7.1.0

Server - teleport , tctl -  Teleport Enterprise v7.1.0 git:v7.1.0-0-gb52a7d89f go1.16.2
Server - tsh - Teleport v7.1.0 git:v7.1.0-0-gb52a7d89f go1.16.2
Client -  teleport, tctl, tsh - Teleport v7.1.0 git:v7.1.0-0-gb52a7d89f go1.16.2

Any further advise will be helpful in troubleshooting

[stevenGravy]

@pankajpandey9 we have released guidance to upgrade past v7.1.0 for security vulnerabilities and miscellaneous issues. I'd recommend upgrading to the current 7.3.0 if not v7.1.3.

[pankajpandey9]

@stevenGravy , Thanks for the suggestion
For now changed the Node configuration from IoT to Auth connection and connections are getting released immediately.

Also, will work on your suggestion to upgrade the version and will check the concurrent sessions