Connection via Cloud Identity-Aware Proxy Failed Code: 4010 Reason: destination read failed [228091306]

Assigned

Bug

Status Update

No update yet.

Description

la...@benkophone.com

created issue #1

Apr 4, 2022 09:56PM

This will create a public issue which anybody can view and comment on.

Please provide as much information as possible. At least, this should include a description of your issue and steps to reproduce the problem. If possible please provide a summary of what steps or workarounds you have already tried, and any docs or articles you found (un)helpful.

Problem you have encountered:

Some VMs randomly show "Connection via Cloud Identity-Aware Proxy Failed
Code: 4010 Reason: destination read failed" when connecting via the SSH button in the cloud console

What you expected to happen:

Successfully connect to the VM

Steps to reproduce:

This is intermittent, and started happening to me yesterday. I can't reliably reproduce it, even the same VM will show the error and then stop showing the error.

Other information (workarounds you have tried, documentation consulted, etc):

Someone else reported the problem here:

https://stackoverflow.com/questions/71670653/connection-via-cloud-identity-aware-proxy-failed-code-4010-reason-destination

There are very few posts online with the 4010 error code, and nothing in the Google docs. I have run through the firewall setup just in case, but it changed nothing. I sort of knew it wouldn't because if it were a firewall problem why would it be intermittent, but thought I'd do that just in case. Anyway it didn't work.

Comments

la...@benkophone.com <la...@benkophone.com> #2Apr 5, 2022 03:35AM

Something else I have experimented with is manually adding SSH keys to the VM and at the project-wide level, and in both cases I can ping the VM but I'm getting a public key error when attempting to login from another server. The VMs that are working with IAP don't have any trouble with the public keys added at the project-wide level, so the key itself seems to be fine.

I also thought perhaps this was a problem with ephemeral IP addresses, so tried promoting them to static but that had no effect.

la...@benkophone.com <la...@benkophone.com> #3Apr 5, 2022 04:01AM

Okay, so what appears to work is resetting the instance. So the current state of affairs is that I can use the "CREATE SIMILAR" button to create a new VM, but can't SSH into the new VM until I have reset it (note that stopping/starting doesn't work -- sometimes the VM doesn't stop at all).

vi...@bmby.com <vi...@bmby.com> #4Apr 5, 2022 05:06PM

all the same. error 4010

nu...@google.com <nu...@google.com> #5Apr 5, 2022 06:19PM

Assigned to gc...@google.com.

Thank you for your report. The Product Team is aware of the issue, and they are addressing it. We do not have an estimated ETA yet, but we will update this public issue when we have an update. Thank you for your patience.

la...@google.com <la...@google.com> #6Jun 27, 2022 01:54PM

Hello, Is there an update to share?

pl...@gmail.com <pl...@gmail.com> #7Jun 28, 2022 10:48PM

Give me eran R eward

pl...@gmail.com <pl...@gmail.com> #8Jun 28, 2022 10:51PM

That

[Deleted User] <[Deleted User]> #9Oct 11, 2022 12:19AM

This could be due to port scanners reaching the default 10 unauthenticated SSH connection limit.

Weirdly, none actually try to authenticate to open a session.

Some spiders and services like Shodan scans public ipv4 addresses for open services, e.g. salt masters, ftp servers, RDPs, and also SSH services. These spiders usually only connect to the services without doing any valid authentication steps.

https://serverfault.com/questions/1015547/what-causes-ssh-error-kex-exchange-identification-connection-closed-by-remote/1015554#1015554

I got this error when using docker command with remote host docker -H ssh://user@server compose up after some digging i found on my remote server in auth logs (/var/log/auth.log) this: Aug 8 14:51:46 user sshd[1341]: error: beginning MaxStartups throttling Aug 8 14:51:46 user sshd[1341]: drop connection #10 from [some_ip]:32992 on [some_ip]:22 past MaxStartups

https://stackoverflow.com/questions/67000681/kex-exchange-identification-connection-closed-by-remote-host/73292521#73292521

MaxStartups Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. Additional connections will be dropped until authentication succeeds or the LoginGraceTime expires for a connection.

https://man7.org/linux/man-pages/man5/sshd_config.5.html

ka...@google.com <ka...@google.com> Jun 16, 2023 03:36AM

Reassigned to ka...@google.com.

ka...@google.com <ka...@google.com> #10Jun 16, 2023 11:24AM

Reassigned to gc...@google.com.

Hello,

Thanks for reaching out to us!

This issue request is acknowledged and we will validate it further. Though we can't provide an ETA on this issue nor guarantee their implementation, rest assured that your feedback is always taken very seriously, as it allows us to improve our products.

Thanks