{"record":{"id":"78630645023bbfdf","repo":"kubernetes/kops","slug":"failed-to-ssh-to-q-with-user-q-w","errorCode":null,"errorMessage":"failed to SSH to %q (with user %q): %w","messagePattern":"failed to SSH to %q \\(with user %q\\): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/commands/toolbox_enroll.go","lineNumber":329,"sourceCode":"\t\treturn nil, fmt.Errorf(\"SSH agent has no keys\")\n\t}\n\n\tsshConfig := &ssh.ClientConfig{\n\t\tHostKeyCallback: func(hostname string, remote net.Addr, key ssh.PublicKey) error {\n\t\t\tklog.Warningf(\"accepting SSH key %v for %q\", key, hostname)\n\t\t\treturn nil\n\t\t},\n\t\tAuth: []ssh.AuthMethod{\n\t\t\t// Use a callback rather than PublicKeys so we only consult the\n\t\t\t// agent once the remote server wants it.\n\t\t\tssh.PublicKeysCallback(agentClient.Signers),\n\t\t},\n\t\tUser: sshUser,\n\t}\n\t// Use net.JoinHostPort so that IPv6 addresses are bracketed correctly.\n\tsshClient, err := ssh.Dial(\"tcp\", net.JoinHostPort(host, strconv.Itoa(sshPort)), sshConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to SSH to %q (with user %q): %w\", host, sshUser, err)\n\t}\n\treturn &SSHHost{\n\t\thostname:  host,\n\t\tsshClient: sshClient,\n\t\tsudo:      sudo,\n\t}, nil\n}\n\nfunc (s *SSHHost) readFile(ctx context.Context, path string) ([]byte, error) {\n\tp := vfs.NewSSHPath(s.sshClient, s.hostname, path, s.sudo)\n\n\treturn p.ReadFile(ctx)\n}\n\nfunc (s *SSHHost) writeFile(ctx context.Context, path string, data io.ReadSeeker) error {\n\tp := vfs.NewSSHPath(s.sshClient, s.hostname, path, s.sudo)\n\treturn p.WriteFile(ctx, data, nil)\n}","sourceCodeStart":311,"sourceCodeEnd":347,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/commands/toolbox_enroll.go#L311-L347","documentation":"With agent-based auth configured, ssh.Dial to host:port failed — TCP unreachable, SSH handshake failure, host unreachable, or the server rejected the agent key (auth attempts exhausted). The HostKeyCallback here accepts any host key, so this is not a host-key failure.","triggerScenarios":"Wrong host/IP or port (default 22 not open), security group/firewall blocking SSH, host powered off or not yet provisioned, the SSH user lacks authorized_keys on the target, or the agent key isn't authorized on the host.","commonSituations":"Enrolling a freshly created VM before its network/security-group rules allow SSH; using the internal vs external IP incorrectly; enrolling with a user other than the one holding the authorized key (e.g. root vs admin on cloud images).","solutions":["Test connectivity: nc -vz <host> <port> and ssh -p <port> <user>@<host>","Verify security group / firewall allows TCP 22 (or custom port) from your source IP","Confirm the agent key is in the target user's authorized_keys","Check the wrapped error: 'connection refused' vs 'handshake failed: ssh: unable to authenticate' points to port vs key problems"],"exampleFix":"// before\nsshHost, err := NewSSHHost(ctx, \"10.0.0.5\", 2022, \"root\", true)  // port 2022 blocked\n// after\n# verify first: ssh -p 22 ubuntu@10.0.0.5\nsshHost, err := NewSSHHost(ctx, \"10.0.0.5\", 22, \"ubuntu\", true)","handlingStrategy":"retry","validationCode":"if err := exec.Command(\"ssh\", \"-p\", strconv.Itoa(port),\n    \"-o\", \"BatchMode=yes\", \"-o\", \"StrictHostKeyChecking=no\",\n    user+\"@\"+host, \"true\").Run(); err != nil {\n    return fmt.Errorf(\"prerequisite ssh to %s@%s:%d failed: %w\", user, host, port, err)\n}","typeGuard":"func sshReachable(host string, port int) bool {\n    conn, err := net.DialTimeout(\"tcp\", net.JoinHostPort(host, strconv.Itoa(port)), 5*time.Second)\n    if err != nil { return false }\n    conn.Close()\n    return true\n}","tryCatchPattern":"var sshHost *SSHHost\nerr := retry.Do(func() error {\n    sshHost, err = NewSSHHost(ctx, hostAddr, port, user, sudo)\n    return err\n}, retry.Attempts(3), retry.Delay(5*time.Second))\nif err != nil {\n    return fmt.Errorf(\"ssh to %q unreachable after retries; check firewall/key auth: %w\", hostAddr, err)\n}","preventionTips":["Test plain ssh <user>@<host> -p <port> before enroll","Open TCP 22 (or custom port) in the cloud security group for your IP","Ensure the agent key is present in the target user's authorized_keys","Use the correct default SSH user for the cloud image (e.g. ubuntu/admin/ec2-user)"],"tags":["ssh","network","authentication"],"backgroundTag":"ssh-connection-refused","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}