{"record":{"id":"94e61ec16f2e1dce","repo":"AlistGo/alist","slug":"only-guest-is-allowed-to-login-without-authorizati","errorCode":null,"errorMessage":"only guest is allowed to login without authorization","messagePattern":"only guest is allowed to login without authorization","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/sftp.go","lineNumber":76,"sourceCode":"func (d *SftpDriver) GetFileSystem(sc *ssh.ServerConn) (sftpd.FileSystem, error) {\n\tuserObj, err := op.GetUserByName(sc.User())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tctx := context.Background()\n\tctx = context.WithValue(ctx, \"user\", userObj)\n\tctx = context.WithValue(ctx, \"meta_pass\", \"\")\n\tctx = context.WithValue(ctx, \"client_ip\", sc.RemoteAddr().String())\n\tctx = context.WithValue(ctx, \"proxy_header\", d.proxyHeader)\n\treturn &sftp.DriverAdapter{FtpDriver: ftp.NewAferoAdapter(ctx)}, nil\n}\n\nfunc (d *SftpDriver) Close() {\n}\n\nfunc (d *SftpDriver) NoClientAuth(conn ssh.ConnMetadata) (*ssh.Permissions, error) {\n\tif conn.User() != \"guest\" {\n\t\treturn nil, errors.New(\"only guest is allowed to login without authorization\")\n\t}\n\tguest, err := op.GetGuest()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tpermGuest := common.MergeRolePermissions(guest, guest.BasePath)\n\tif guest.Disabled || !common.HasPermission(permGuest, common.PermFTPAccess) {\n\t\treturn nil, errors.New(\"user is not allowed to access via SFTP\")\n\t}\n\treturn nil, nil\n}\n\nfunc (d *SftpDriver) PasswordAuth(conn ssh.ConnMetadata, password []byte) (*ssh.Permissions, error) {\n\tuserObj, err := op.GetUserByName(conn.User())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tperm := common.MergeRolePermissions(userObj, userObj.BasePath)","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/AlistGo/alist/blob/843d9dc8149126976b2625911e45a4d3ffd6f2f5/server/sftp.go#L58-L94","documentation":"Returned by SftpDriver.NoClientAuth when a client attempts SSH 'none' authentication (no password, no key) with a username other than 'guest'. AList's SFTP gateway only permits anonymous none-auth for the guest account; every other account must authenticate via PasswordAuth or PublicKeyAuth.","triggerScenarios":"SSH/SFTP connection with 'none' as the only attempted method while the client username is not exactly 'guest' — e.g. an sshd-style default that tries none-auth as user root or the local OS username.","commonSituations":"Automated tooling (scp/rsync-over-ssh, CI bots) that connects without credentials; ssh config carrying the wrong User; clients that probe none-auth first and surface its rejection instead of falling through to password auth.","solutions":["Authenticate with real credentials: connect as the AList username and supply the account password (or public key)","For anonymous access, set the SSH username to exactly 'guest'","Check ~/.ssh/config for a stale User entry overriding the intended one"],"exampleFix":"// before\nsftp root@alist-host  (no password offered)\n// after\nsftp alice@alist-host   (password auth)","handlingStrategy":"validation","validationCode":"// Client-side: only attempt none-auth when the username is exactly 'guest'\nif sshUser != \"guest\" {\n    requireAuthMethods(ssh.PasswordCallback(providePwd), ssh.PublicKeyCallback(keyFn))\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"only guest is allowed to login without authorization\") {\n    // switch to password/publickey auth for this username; do not retry none-auth\n}","preventionTips":["Always set an explicit User in ssh config for AList SFTP hosts","Pass credentials to automation tools (scp/rsync/CI) instead of relying on none-auth","Remember none-auth only ever works for the guest account"],"tags":["sftp","ssh","auth"],"backgroundTag":null,"analyzedSha":"843d9dc8149126976b2625911e45a4d3ffd6f2f5","analyzedAt":"2026-08-15T12:14:11.722Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}