SSH: Received disconnect: Too many authentication failures

What the message looks like

Received disconnect from 203.0.113.10 port 22:2: Too many authentication failures
Disconnected from 203.0.113.10 port 22
user@203.0.113.10: Permission denied (publickey).

Common causes

• The ssh-agent holds many keys and offers them one after another.
• No IdentityFile is set for the host, so ssh tries all default keys and agent keys.
• The right key is not authorized on the server.
• MaxAuthTries on the server is low.
• Old keys in ~/.ssh are tried first.

Check

1. How many keys does the agent hold?
   ssh-add -lCopy
2. Which keys are offered, and in which order?
   ssh -v user@server.example.com 2>&1 | grep -iE 'offering|authentications that can continue'Copy
3. The limit on the server (console or another access)
   sshd -T | grep -i maxauthtriesCopy

Fix

• Offer only the key you name: ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 user@server.example.com.
• Make it permanent in ~/.ssh/config: Host server, IdentityFile ~/.ssh/id_ed25519, IdentitiesOnly yes.
• Remove unneeded keys from the agent: ssh-add -D, then add only what you need with ssh-add ~/.ssh/id_ed25519.
• Check that the public key is in ~/.ssh/authorized_keys on the server with the right permissions.
• Raise MaxAuthTries on the server only if you really must; fewer keys is the better fix.

FAQ

Why can I not even type my password?

Key attempts come first. The limit is reached before ssh gets to password authentication.

Is this the same as a ban by fail2ban?

No. This disconnect is a single connection hitting the per-connection limit. A fail2ban ban blocks your address and shows as a timeout or refusal, see port 22 timed out.