only guest is allowed to login without authorization

Error message

only guest is allowed to login without authorization

What it means

Returned by SftpDriver.NoClientAuth when a client attempts SSH 'none' authentication (no password, no key) with a username other than 'guest'. AList's SFTP gateway only permits anonymous none-auth for the guest account; every other account must authenticate via PasswordAuth or PublicKeyAuth.

Source

Thrown at server/sftp.go:76

func (d *SftpDriver) GetFileSystem(sc *ssh.ServerConn) (sftpd.FileSystem, error) {
	userObj, err := op.GetUserByName(sc.User())
	if err != nil {
		return nil, err
	}
	ctx := context.Background()
	ctx = context.WithValue(ctx, "user", userObj)
	ctx = context.WithValue(ctx, "meta_pass", "")
	ctx = context.WithValue(ctx, "client_ip", sc.RemoteAddr().String())
	ctx = context.WithValue(ctx, "proxy_header", d.proxyHeader)
	return &sftp.DriverAdapter{FtpDriver: ftp.NewAferoAdapter(ctx)}, nil
}

func (d *SftpDriver) Close() {
}

func (d *SftpDriver) NoClientAuth(conn ssh.ConnMetadata) (*ssh.Permissions, error) {
	if conn.User() != "guest" {
		return nil, errors.New("only guest is allowed to login without authorization")
	}
	guest, err := op.GetGuest()
	if err != nil {
		return nil, err
	}
	permGuest := common.MergeRolePermissions(guest, guest.BasePath)
	if guest.Disabled || !common.HasPermission(permGuest, common.PermFTPAccess) {
		return nil, errors.New("user is not allowed to access via SFTP")
	}
	return nil, nil
}

func (d *SftpDriver) PasswordAuth(conn ssh.ConnMetadata, password []byte) (*ssh.Permissions, error) {
	userObj, err := op.GetUserByName(conn.User())
	if err != nil {
		return nil, err
	}
	perm := common.MergeRolePermissions(userObj, userObj.BasePath)

View on GitHub (pinned to 843d9dc814)

Solutions

Authenticate with real credentials: connect as the AList username and supply the account password (or public key)
For anonymous access, set the SSH username to exactly 'guest'
Check ~/.ssh/config for a stale User entry overriding the intended one

Example fix

// before
sftp root@alist-host  (no password offered)
// after
sftp alice@alist-host   (password auth)

Defensive patterns

Strategy: validation

Validate before calling

// Client-side: only attempt none-auth when the username is exactly 'guest'
if sshUser != "guest" {
    requireAuthMethods(ssh.PasswordCallback(providePwd), ssh.PublicKeyCallback(keyFn))
}

Try / catch

if err != nil && strings.Contains(err.Error(), "only guest is allowed to login without authorization") {
    // switch to password/publickey auth for this username; do not retry none-auth
}

Prevention

Always set an explicit User in ssh config for AList SFTP hosts
Pass credentials to automation tools (scp/rsync/CI) instead of relying on none-auth
Remember none-auth only ever works for the guest account

When it happens

Trigger: SSH/SFTP connection with 'none' as the only attempted method while the client username is not exactly 'guest' — e.g. an sshd-style default that tries none-auth as user root or the local OS username.

Common situations: Automated tooling (scp/rsync-over-ssh, CI bots) that connects without credentials; ssh config carrying the wrong User; clients that probe none-auth first and surface its rejection instead of falling through to password auth.

Related errors

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/94e61ec16f2e1dce. Report an issue: GitHub.