OpenSSH · Event Connection closed [preauth]
SSH: connection closed before authentication finished
A connection reached the SSH server and went away before anyone logged in. The [preauth] marker is the important part: it means no authentication completed, so nobody got in. On an internet-facing server these are the single most common lines in the auth log.
Also written as Connection closed by preauthssh preauth disconnect logConnection reset by peer preauth
- How oftenFires constantly
- Vendor calls itauth.info
- Logauth
What it means for you
On a personal computer
Automated programs scan the whole internet constantly looking for SSH servers. They connect, look at what answers, and leave. That is what these lines are. Nobody got in — the message says the connection closed before any login was completed.
For an analyst
The variants matter and get flattened together in most dashboards. 'Connection closed by 203.0.113.5 port 40912 [preauth]' with no username is a scanner or a health check that never attempted authentication. 'Connection closed by authenticating user root 203.0.113.5 port 40912 [preauth]' means credentials were offered and the client gave up mid-exchange, which is closer to a guessing attempt that ran out of options. And 'Connection closed by invalid user X' tells you the username enumeration succeeded in learning that X does not exist.
The fields that decide it
Everything else in the log line is context.
- Whether a username appears
- The single most informative distinction in this message.
-
No usernameThe client connected and left without attempting authentication. A scanner, a port check, or a monitoring probe. -
authenticating user <valid name>Credentials were offered for a real account and the client disconnected. Worth reading alongside what came before it. -
invalid user <name>The account does not exist. Automated guessing working through a list. - Source address
- Where from. Your own monitoring system will appear here constantly and is worth excluding before you look at anything else.
- [preauth] marker
- Confirms the disconnection happened before authentication completed. Its presence is what makes this message safe rather than alarming.
- Volume and spread
- Not a field. One address hitting once is background; one address hitting hundreds of times, or hundreds of addresses in an hour, is a campaign — though still one that got nowhere.
Common questions
Does 'Connection closed by ... [preauth]' mean someone got in?
No, and the [preauth] marker is exactly what tells you so. It means the connection ended during the pre-authentication phase, before any credentials were accepted. A successful login produces an 'Accepted password' or 'Accepted publickey' line instead, and there is no ambiguity between the two.
Why do I have thousands of these on an internet-facing server?
Because the entire IPv4 internet is scanned continuously, and any host with port 22 open answers. Most of the connections you see never attempt to log in at all — they connect, read the version banner, and disconnect. This is background radiation rather than an attack on you specifically.
What is the difference between 'Connection closed by 203.0.113.5' and 'Connection closed by authenticating user root 203.0.113.5'?
The first had no authentication attempt at all: something connected and left, typically a scanner or a monitoring check. The second offered credentials for the root account and then gave up part-way through. The second form means someone got as far as trying, which makes it more interesting — though still unsuccessful.
Should I do anything about these?
Only if the volume is causing you a problem, since nothing is getting through. The measures that genuinely help are restricting SSH by source address or putting it behind a VPN, and disabling password authentication so guessing cannot work at all. Rate-limiting tools reduce the log noise. Changing the port helps against indiscriminate scanning and not at all against anyone targeting you.
Read next
- Read alongside Invalid user: an SSH login for an account that does not exist The attempt against a non-existent account that frequently precedes this line.
- The equivalent of SSH: maximum authentication attempts exceeded A connection cut off by the server for too many attempts, rather than closed by the client.
- Read alongside Failed password: an SSH login was rejected Password failures, which is what the same scanners produce when they get further.
- Usually comes after Accepted password: an SSH login succeeded A successful login — the thing worth checking for from any address that appears here repeatedly.
Mentioned by
Vendor documentation
Last reviewed 6 September 2026