{"record":{"id":"bda2295cd29eba99","repo":"ginuerzh/gost","slug":"unknown-public-key-for-q","errorCode":null,"errorMessage":"unknown public key for %q","messagePattern":"unknown public key for %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ssh.go","lineNumber":897,"sourceCode":"// PublicKeyCallbackFunc is a callback function used by SSH server.\n// It offers a public key for authentication.\ntype PublicKeyCallbackFunc func(c ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error)\n\nfunc defaultSSHPublicKeyCallback(keys map[string]bool) PublicKeyCallbackFunc {\n\tif len(keys) == 0 {\n\t\treturn nil\n\t}\n\n\treturn func(c ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {\n\t\tif keys[string(pubKey.Marshal())] {\n\t\t\treturn &ssh.Permissions{\n\t\t\t\t// Record the public key used for authentication.\n\t\t\t\tExtensions: map[string]string{\n\t\t\t\t\t\"pubkey-fp\": ssh.FingerprintSHA256(pubKey),\n\t\t\t\t},\n\t\t\t}, nil\n\t\t}\n\t\treturn nil, fmt.Errorf(\"unknown public key for %q\", c.User())\n\t}\n}\n\ntype sshNopConn struct {\n\tsession *sshSession\n}\n\nfunc (c *sshNopConn) Read(b []byte) (n int, err error) {\n\treturn 0, &net.OpError{Op: \"read\", Net: \"ssh\", Source: nil, Addr: nil, Err: errors.New(\"read not supported\")}\n}\n\nfunc (c *sshNopConn) Write(b []byte) (n int, err error) {\n\treturn 0, &net.OpError{Op: \"write\", Net: \"ssh\", Source: nil, Addr: nil, Err: errors.New(\"write not supported\")}\n}\n\nfunc (c *sshNopConn) Close() error {\n\treturn nil\n}","sourceCodeStart":879,"sourceCodeEnd":915,"githubUrl":"https://github.com/ginuerzh/gost/blob/a33fdbf4c98034f4bfeeaea9868909822b9c526d/ssh.go#L879-L915","documentation":"Raised by the SSH server's public key authentication callback: the client presented a public key that is not in the server's authorized key set, so the callback returns 'unknown public key for \"<user>\"' and the handshake fails. The Extensions map ('pubkey-fp') shows that valid keys are recorded with a SHA256 fingerprint on success.","triggerScenarios":"An SSH client authenticates with a public key whose fingerprint does not match any key configured in the server's authenticator (au), causing the final return of fmt.Errorf(\"unknown public key for %q\", c.User()).","commonSituations":"Client using a new/rotated key not yet added to the server's authorized keys; pointing the server at the wrong authorized-keys file; key format mismatch; testing with a throwaway keypair.","solutions":["Add the client's public key (check its SHA256 fingerprint against server logs/config) to the server's authorized key set","Verify the authenticator is pointed at the intended authorized-keys source","Regenerate or copy the correct client keypair and retry","Confirm the client offers the expected key (ssh -v or client logs) rather than a different default key"],"exampleFix":"// before: server only knows old-key.pub\nauthorizedKeys := []ssh.PublicKey{oldKey}\n// after: add the client's new key\nauthorizedKeys := append(authorizedKeys, newClientPubKey)","handlingStrategy":"validation","validationCode":"// before connecting, confirm the client key is authorized\nfp := fingerprintSHA256(pubKeyBytes) // compute locally\nif !allowedFingerprints[fp] {\n    return fmt.Errorf(\"key %s is not in server authorized keys\", fp)\n}","typeGuard":null,"tryCatchPattern":"client, err := ssh.Dial(\"tcp\", addr, &ssh.ClientConfig{\n    Auth: []ssh.AuthMethod{ssh.PublicKeys(signer)},\n})\nif err != nil {\n    if strings.Contains(err.Error(), \"unknown public key\") {\n        return fmt.Errorf(\"install the client public key on the server: %w\", err)\n    }\n    return err\n}","preventionTips":["Add each client public key to the server's authorized key set before rollout","Compare SHA256 fingerprints (as the server logs in pubkey-fp) when debugging","Point the server authenticator at the correct authorized-keys file","Use ssh -v (OpenSSH) or client logs to confirm which key is being offered"],"tags":["ssh","authentication","public-key","authorized-keys"],"backgroundTag":"ssh-unauthorized-public-key","analyzedSha":"a33fdbf4c98034f4bfeeaea9868909822b9c526d","analyzedAt":"2026-09-02T22:15:54.506Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}