{"record":{"id":"2f01cc80226ae156","repo":"ginuerzh/gost","slug":"password-rejected-for-s","errorCode":null,"errorMessage":"password rejected for %s","messagePattern":"password rejected for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ssh.go","lineNumber":875,"sourceCode":"\t}\n\tport, err = strconv.Atoi(portString)\n\treturn\n}\n\n// PasswordCallbackFunc is a callback function used by SSH server.\n// It authenticates user using a password.\ntype PasswordCallbackFunc func(conn ssh.ConnMetadata, password []byte) (*ssh.Permissions, error)\n\nfunc defaultSSHPasswordCallback(au Authenticator) PasswordCallbackFunc {\n\tif au == nil {\n\t\treturn nil\n\t}\n\treturn func(conn ssh.ConnMetadata, password []byte) (*ssh.Permissions, error) {\n\t\tif au.Authenticate(conn.User(), string(password)) {\n\t\t\treturn nil, nil\n\t\t}\n\t\tlog.Logf(\"[ssh] %s -> %s : password rejected for %s\", conn.RemoteAddr(), conn.LocalAddr(), conn.User())\n\t\treturn nil, fmt.Errorf(\"password rejected for %s\", conn.User())\n\t}\n}\n\n// PublicKeyCallbackFunc is a callback function used by SSH server.\n// It offers a public key for authentication.\ntype PublicKeyCallbackFunc func(c ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error)\n\nfunc defaultSSHPublicKeyCallback(keys map[string]bool) PublicKeyCallbackFunc {\n\tif len(keys) == 0 {\n\t\treturn nil\n\t}\n\n\treturn func(c ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {\n\t\tif keys[string(pubKey.Marshal())] {\n\t\t\treturn &ssh.Permissions{\n\t\t\t\t// Record the public key used for authentication.\n\t\t\t\tExtensions: map[string]string{\n\t\t\t\t\t\"pubkey-fp\": ssh.FingerprintSHA256(pubKey),","sourceCodeStart":857,"sourceCodeEnd":893,"githubUrl":"https://github.com/ginuerzh/gost/blob/a33fdbf4c98034f4bfeeaea9868909822b9c526d/ssh.go#L857-L893","documentation":"This error is produced by the SSH server's password authentication callback when au.Authenticate(user, password) returns false. The server rejects the client's password attempt and closes the handshake with 'password rejected for <user>'. It is a server-side auth failure, not a network fault.","triggerScenarios":"An SSH client attempts password authentication against a server built with PasswordCallbackFunc, and the configured authenticator (auth.Authenticate) does not accept the supplied username/password pair.","commonSituations":"Wrong password in client config; user not present in the server's auth file; authenticator misconfigured (wrong whitelist file path); credential rotation/typo after redeploy.","solutions":["Verify the client's username and password against the server's configured authenticator source","Check server logs for the '[ssh] ... password rejected for <user>' line to confirm which user failed","Regenerate/update credentials and restart/reload the server authenticator","If public keys are intended, switch the client to key auth and configure PublicKeyCallbackFunc instead"],"exampleFix":"// server-side: ensure authenticator loads the right users\n// before\nau := auth.NewStaticAuthenticator(...list missing user...)\n// after\nau := auth.NewStaticAuthenticator(\"user\", \"correct-password\", nil)","handlingStrategy":"validation","validationCode":"// client-side: verify credentials before connecting\nif user == \"\" || pass == \"\" {\n    return errors.New(\"ssh password auth requires non-empty credentials\")\n}","typeGuard":null,"tryCatchPattern":"client, err := ssh.Dial(\"tcp\", addr, &ssh.ClientConfig{\n    Auth: []ssh.AuthMethod{ssh.Password(pass)},\n})\nif err != nil {\n    if strings.Contains(err.Error(), \"password rejected\") {\n        return fmt.Errorf(\"check username/password for %s: %w\", user, err)\n    }\n    return err\n}","preventionTips":["Keep client credentials in sync with the server authenticator (file/env)","Check server logs for 'password rejected for <user>' to confirm the failing user","Rotate credentials atomically on both ends","Prefer key-based auth to avoid password mismatches"],"tags":["ssh","authentication","password"],"backgroundTag":"ssh-password-auth-rejected","analyzedSha":"a33fdbf4c98034f4bfeeaea9868909822b9c526d","analyzedAt":"2026-09-02T22:15:54.506Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}