{"record":{"id":"46d5bb824458902d","repo":"hashicorp/terraform","slug":"error-creating-new-client-connection-via-proxy-s","errorCode":null,"errorMessage":"Error creating new client connection via proxy: %s","messagePattern":"Error creating new client connection via proxy: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/communicator/ssh/communicator.go","lineNumber":852,"sourceCode":"\n\t\t// Wrap connection to bastion server if proxy server is configured\n\t\tif p != nil {\n\t\t\tvar pConn net.Conn\n\t\t\tvar bConn ssh.Conn\n\t\t\tvar bChans <-chan ssh.NewChannel\n\t\t\tvar bReq <-chan *ssh.Request\n\n\t\t\tRegisterDialerType()\n\t\t\tpConn, err = newHttpProxyConn(p, bAddr)\n\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"Error connecting to proxy: %s\", err)\n\t\t\t}\n\n\t\t\tbConn, bChans, bReq, err = ssh.NewClientConn(pConn, bAddr, bConf)\n\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"Error creating new client connection via proxy: %s\", err)\n\t\t\t}\n\n\t\t\tbastion = ssh.NewClient(bConn, bChans, bReq)\n\t\t} else {\n\t\t\tbastion, err = ssh.Dial(bProto, bAddr, bConf)\n\t\t}\n\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Error connecting to bastion: %s\", err)\n\t\t}\n\n\t\tlog.Printf(\"[DEBUG] Connecting via bastion (%s) to host: %s\", bAddr, addr)\n\t\tconn, err := bastion.Dial(proto, addr)\n\t\tif err != nil {\n\t\t\tbastion.Close()\n\t\t\treturn nil, err\n\t\t}\n","sourceCodeStart":834,"sourceCodeEnd":870,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/communicator/ssh/communicator.go#L834-L870","documentation":"Raised in BastionConnectFunc when ssh.NewClientConn(pConn, bAddr, bConf) fails after the HTTP proxy tunnel to the bastion was successfully established. The proxy CONNECT succeeded, but the SSH protocol handshake (key exchange, authentication) over that tunneled connection failed.","triggerScenarios":"The proxy tunnel is open but the SSH handshake to the bastion fails: wrong bastion credentials, unsupported SSH key exchange algorithm, bastion sshd config mismatch, or the bastion private key is invalid for the tunneled connection.","commonSituations":"bastion_private_key does not match the bastion's authorized keys, bastion_user is wrong, the bastion sshd has restrictive algorithm/KexAlgorithms settings incompatible with the Go x/crypto/ssh client, or the proxy tunneled to the wrong port.","solutions":["Verify bastion_user, bastion_private_key, and bastion_password are correct for the bastion host.","Confirm the bastion address and port (bAddr) the proxy is tunneling to is correct.","Check the bastion sshd allows the key exchange algorithms supported by the Go SSH client.","Test SSH to the bastion manually through the proxy to isolate the handshake failure."],"exampleFix":"// before\nconnection {\n  bastion_host = var.bastion\n  proxy_host   = var.proxy\n}\n\n// after\nconnection {\n  bastion_host       = var.bastion\n  bastion_user       = \"ec2-user\"\n  bastion_private_key = file(\"~/.ssh/bastion_key\")\n  proxy_host         = var.proxy\n}","handlingStrategy":"validation","validationCode":"// Validate bastion SSH credentials through the proxy before the full run\nfunc validateBastionViaProxy(proxyURL, bastionAddr, user, privateKey string) error {\n    // Use a quick SSH dial test through the proxy to catch auth/handshake issues early\n    signer, err := ssh.ParsePrivateKey([]byte(privateKey))\n    if err != nil {\n        return fmt.Errorf(\"invalid bastion private key: %w\", err)\n    }\n    config := &ssh.ClientConfig{\n        User:            user,\n        Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},\n        HostKeyCallback: ssh.InsecureIgnoreHostKey(),\n        Timeout:         10 * time.Second,\n    }\n    // (dial through proxy omitted for brevity)\n    _ = config\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify bastion_user and bastion_private_key match the bastion's authorized credentials.","Confirm the bastion sshd supports the key exchange algorithms used by Go's SSH client.","Test SSH to the bastion through the proxy manually before provisioning."],"tags":["ssh","proxy","bastion","handshake","authentication","terraform"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}