{"record":{"id":"3b565e3137247d11","repo":"pentaho/pentaho-kettle","slug":"ssh-authentication-failed","errorCode":null,"errorMessage":"SSH authentication failed","messagePattern":"SSH authentication failed","errorType":"exception","errorClass":"SshAuthenticationException","httpStatus":null,"severity":"error","filePath":"engine/src/main/java/org/pentaho/di/core/ssh/mina/MinaSshConnection.java","lineNumber":294,"sourceCode":"    if ( s == null ) {\n      throw new SshConnectionException( \"SSH connection failed - session is null\" );\n    }\n\n    return s;\n  }\n\n  private void authenticateSession() throws SshConnectionException {\n    log( DEBUG, \"Starting SSH authentication - Auth type: \" + config.getAuthType() );\n    boolean authed = tryPublicKeyAuthentication();\n\n    if ( !authed ) {\n      log( DEBUG, \"Public key authentication failed or not configured, trying password authentication\" );\n      authed = tryPasswordAuthentication();\n    }\n\n    if ( !authed ) {\n      log( ERROR, \"All SSH authentication methods failed\" );\n      throw new SshAuthenticationException( \"SSH authentication failed\" );\n    } else {\n      log( BASIC, \"SSH authentication successful\" );\n    }\n  }\n\n  private boolean tryPublicKeyAuthentication() throws SshAuthenticationException {\n    if ( config.getAuthType() != SshConfig.AuthType.PUBLIC_KEY ) {\n      log( DEBUG, \"Skipping public key authentication - not configured\" );\n      return false;\n    }\n\n    log( DEBUG, \"Attempting SSH public key authentication\" );\n\n    try {\n      KeyPairProvider keyPairProvider = loadKeyPairProvider();\n      if ( keyPairProvider == null ) {\n        return false;\n      }","sourceCodeStart":276,"sourceCodeEnd":312,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/engine/src/main/java/org/pentaho/di/core/ssh/mina/MinaSshConnection.java#L276-L312","documentation":"authenticateSession throws SshAuthenticationException('SSH authentication failed') after neither public key nor password authentication succeeded. The server rejected every configured credential method. This happens after TCP connect succeeded, so it is purely a credentials/authorization issue.","triggerScenarios":"connect() reaches authenticateSession; tryPublicKeyAuthentication returns false or throws, and tryPasswordAuthentication also fails/returns false — e.g. wrong password, wrong key, or user not permitted.","commonSituations":"Wrong password stored in job metadata; private key not matching the server's authorized_keys; PasswordAuthentication disabled on server while key is unconfigured; user locked or shell disabled.","solutions":["Verify username/password by logging in manually with ssh","Confirm the private key corresponds to an entry in ~/.ssh/authorized_keys on the server","Enable debug logging to see which auth methods were attempted","Check sshd_config: ensure PasswordAuthentication or PubkeyAuthentication is enabled for the chosen method","Verify the user account is active (not expired/locked: chage -l, passwd -S)"],"exampleFix":"// before\nconfig.setPassword( \"pass\" ); // stale password after rotation\n// after\nconfig.setPassword( System.getenv( \"SSH_PASSWORD\" ) ); // current, from secure source","handlingStrategy":"try-catch","validationCode":"// pre-validate credentials before running the job\nProcess p = new ProcessBuilder( \"ssh\", \"-o\", \"BatchMode=yes\", \"-o\", \"ConnectTimeout=5\",\n    user + \"@\" + host, \"true\" ).start();\nboolean ok = p.waitFor() == 0; // non-zero => credentials/method unusable","typeGuard":null,"tryCatchPattern":"try { conn.connect(); }\ncatch ( SshAuthenticationException e ) {\n  log.error( \"Auth rejected for user {} on {}: check password/authorized_keys\", user, host );\n  // do NOT blindly retry — triggers fail2ban/MaxAuthTries\n}","preventionTips":["Validate credentials with a manual ssh login before configuring jobs","Prefer key-based auth with the public key installed in authorized_keys","Rotate credentials centrally, not ad hoc in job metadata","Check account status (expiry/lock) on the server"],"tags":["ssh","authentication","credentials"],"backgroundTag":"authentication-required","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}