Problems with sshd

[Paul Schmehl]

I manage a small hobby website for some friends.  The system has been 
running fine for quite a while, but suddenly the owners are having 
problems using WinSCP to transfer files to the server.  The only thing 
that has changed recently is their internet service, and I'm inclined to 
think that's the cause.  They are using a Verizon hotspot, whatever that 
is.  (They live in the country, and options for internet service are 
limited.)

But I'm the thorough sort, so I've enabled verbose logging and been 
googling for possible causes.  One thing I've noticed is that their IP 
address changes quite frequently, but this snippet from the log shows that 
it also happens with the same IP.  (I changed the username to protect 
their privacy.)

Checking the archived logs, which go back several months, the "error: 
ssh_msg_send: write" entry appears occasionally whenever they login using 
WinSCP, so I assume it's some incompatibility about the program that rears 
its ugly head from time to time.  I suspect it has no significance wrt 
this particular problem.

Any thoughts on possible things to check for would be most welcome.

Jul 15 07:19:33 www sshd[55490]: subsystem request for sftp
Jul 15 07:30:03 www sshd[55529]: Accepted keyboard-interactive/pam for 
user from 166.248.39.94 port 40850 ssh2
Jul 15 07:30:03 www sshd[55544]: subsystem request for sftp
Jul 15 07:39:56 www sshd[55564]: error: ssh_msg_send: write
Jul 15 07:43:14 www sshd[55570]: error: ssh_msg_send: write
Jul 15 07:46:39 www sshd[55596]: Accepted keyboard-interactive/pam for 
user from 166.248.39.94 port 40851 ssh2
Jul 15 07:46:40 www sshd[55608]: subsystem request for sftp
Jul 15 07:49:31 www sshd[55610]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 27437 ssh2
Jul 15 07:49:32 www sshd[55613]: subsystem request for sftp
Jul 15 07:56:59 www sshd[55634]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 27436 ssh2
Jul 15 07:57:00 www sshd[55637]: subsystem request for sftp
Jul 15 08:26:15 www sshd[55751]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 27440 ssh2
Jul 15 08:26:15 www sshd[55755]: subsystem request for sftp
Jul 15 08:30:59 www sshd[55779]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 48390 ssh2
Jul 15 08:30:59 www sshd[55782]: subsystem request for sftp
Jul 15 08:47:07 www sshd[55852]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 27446 ssh2
Jul 15 08:47:07 www sshd[55855]: subsystem request for sftp
Jul 15 09:01:26 www sshd[55897]: error: ssh_msg_send: write
Jul 15 10:55:48 www sshd[56416]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 27426 ssh2
Jul 15 10:55:49 www sshd[56419]: subsystem request for sftp
Jul 15 11:44:02 www sshd[56579]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 27449 ssh2
Jul 15 11:44:03 www sshd[56595]: subsystem request for sftp
Jul 15 11:48:22 www sshd[56615]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 27433 ssh2
Jul 15 11:48:22 www sshd[56618]: subsystem request for sftp
Jul 15 11:51:24 www sshd[56624]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 51389 ssh2
Jul 15 11:51:24 www sshd[56627]: subsystem request for sftp
Jul 15 12:04:22 www sshd[56717]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 27430 ssh2
Jul 15 12:04:22 www sshd[56720]: subsystem request for sftp
Jul 15 12:08:35 www sshd[56725]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 51383 ssh2
Jul 15 12:08:36 www sshd[56728]: subsystem request for sftp
Jul 15 12:11:55 www sshd[56755]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 51361 ssh2
Jul 15 12:11:56 www sshd[56758]: subsystem request for sftp
Jul 15 12:36:39 www sshd[56855]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 21268 ssh2
Jul 15 12:36:39 www sshd[56858]: subsystem request for sftp
Jul 15 12:44:02 www sshd[56863]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 27452 ssh2
Jul 15 12:44:02 www sshd[56879]: subsystem request for sftp
Jul 15 12:49:20 www sshd[56904]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 27454 ssh2
Jul 15 12:49:20 www sshd[56907]: subsystem request for sftp
Jul 15 12:53:25 www sshd[56918]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 27424 ssh2
Jul 15 12:53:25 www sshd[56921]: subsystem request for sftp
Jul 15 12:57:42 www sshd[56951]: Accepted keyboard-interactive/pam for 
user from 166.248.39.172 port 27425 ssh2
Jul 15 12:57:42 www sshd[56954]: subsystem request for sftp

Paul Schmehl, If it isn't already
obvious, my opinions are my own
and not those of my employer.
******************************************
"When intelligence argues with stupidity and bias,
intelligence is bound to lose; intelligence has limits,
but stupidity and bias have none."