Why does an ssh connection abort with the error "File size limit exceeded" (4280684)

Why does an ssh connection abort with the error "File size limit exceeded"

An ssh connection aborts with the error "File size limit exceeded"
This occurs when you are using the fsize option in /etc/security/limits.conf

This is an OpenSSH issue that is caused by the size of the /var/log/lastlog file.
Lastlog is a sparse file which is seen as being over the fsize limit set in /etc/security/limits.conf.

The size of lastlog is determined by the highest UID number in use, therefore you are likely to encounter the issue if you are using high UID numbers in your environment.

The following Redhat article describes the lastlog size issue when using high UID numbers:
https://bugzilla.redhat.com/show_bug.cgi?id=771286

Fixed in portable openSSH under defect 2263:
https://bugzilla.mindrot.org/show_bug.cgi?id=2263

Contact your ssh vendor to determine if they have a fix for this defect.
Portable OpenSSH fixed this issue in August 2014 under defect number 2263.

WORKAROUND 1:
Use lower UID numbers.
Please see the following Knowledgebase article on how to set lower UID numbers for Authentication Services users:
https://support.quest.com/authentication-services/kb/125786

WORKAROUND 2:
Remove or increase the fsize entry in /etc/security/limits.conf until the issue has been resolved by your ssh vendor.

A strace of the sshd process shows the following error: ---------- stat("/var/log/lastlog", {st_mode=S_IFREG|0644, st_size=517245029404, ...}) = 0 open("/var/log/lastlog", O_RDWR|O_CREAT, 0600) = 8 lseek(8, 15272184, SEEK_SET) = 15272184 write(8, "\326\346\334Tpts/1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 292) = -1 EFBIG (File too large) --- SIGXFSZ (File size limit exceeded) @ 0 (0) --- debug1: do_cleanup debug3: PAM: sshpam_thread_cleanup entering debug3: mm_request_send entering: type 80 mm_request_send: write: Broken pipe +++ killed by SIGXFSZ +++ File size limit exceeded (core dumped) ---------- lastlog is a sparse file which sets the filesize to the largesst UID number in use. ssh incorrectly determines the size of the sparse file and fails if it is over the limit set in fsize option. The following Redhat article describes the issue of a large lastlog file when using high UID numbers: https://bugzilla.redhat.com/show_bug.cgi?id=771286 Fixed in portable openSSH under defect 2263: https://bugzilla.mindrot.org/show_bug.cgi?id=2263