{"record":{"id":"d963732f52370470","repo":"kubernetes/kops","slug":"error-creating-sftp-client-in-new-session-w","errorCode":null,"errorMessage":"error creating sftp client (in new-session): %w","messagePattern":"error creating sftp client \\(in new-session\\): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/sshfs.go","lineNumber":67,"sourceCode":"\t\tclient: client,\n\t\tserver: server,\n\t\tpath:   path,\n\t\tsudo:   sudo,\n\t}\n}\n\nfunc (p *SSHPath) newClient(ctx context.Context) (*sftp.Client, error) {\n\tif !p.sudo {\n\t\tsftpClient, err := sftp.NewClient(p.client)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error creating sftp client: %w\", err)\n\t\t}\n\n\t\treturn sftpClient, nil\n\t}\n\ts, err := p.client.NewSession()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating sftp client (in new-session): %w\", err)\n\t}\n\n\tstdin, err := s.StdinPipe()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating sftp client (at stdin pipe): %w\", err)\n\t}\n\tstdout, err := s.StdoutPipe()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating sftp client (at stdout pipe): %w\", err)\n\t}\n\n\terr = s.Start(\"sudo /usr/lib/openssh/sftp-server\")\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating sftp client (executing 'sudo /usr/lib/openssh/sftp-server'): %w\", err)\n\t}\n\n\tc, err := sftp.NewClientPipe(stdout, stdin)\n\tif err != nil {","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/sshfs.go#L49-L85","documentation":"SSHPath.newClient in util/pkg/vfs/sshfs.go wraps errors from p.client.NewSession() with this message when the sudo=true path tries to open a new SSH session to run `sudo /usr/lib/openssh/sftp-server`. It means the SSH connection exists but a new session channel could not be opened — commonly because the server hit the session limit, the connection dropped, or the server refuses session channels for this user.","triggerScenarios":"Any SSHPath operation with sudo=true where client.NewSession() fails: sshd MaxSessions exhausted (each operation opens a new session), connection closed by the remote host, or the ssh.Client is stale after an idle timeout or network change.","commonSituations":"Using an ssh:// VFS with sudo=true against a node whose sshd limits sessions (MaxSessions=1 or low); firewall/NAT dropping idle SSH connections; connecting with a client that was closed elsewhere; restricted accounts with session channel limits.","solutions":["Raise MaxSessions in the remote sshd_config and reload sshd","Re-establish the ssh.Client and retry — the existing one is likely stale or closed","Check for NAT/firewall idle timeouts; enable SSH keepalives on the client","Verify the account is permitted to open session channels (not restricted to a single forced command)"],"exampleFix":"// before (server sshd_config)\nMaxSessions 1\n// after\nMaxSessions 10\n# then: sudo systemctl reload sshd","handlingStrategy":"retry","validationCode":"// check MaxSessions reachability before VFS use\ns, err := client.NewSession()\nif err != nil {\n\tlog.Fatalf(\"cannot open ssh session to %s: %v (check sshd MaxSessions)\", host, err)\n}\ns.Close()","typeGuard":"func isSSHSessionError(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"sftp client (in new-session)\")\n}","tryCatchPattern":"err := p.WriteFile(ctx, data, acl)\nif err != nil && strings.Contains(err.Error(), \"error creating sftp client (in new-session)\") {\n\t// stale/limited connection: re-dial and retry once\n\tclient, derr := ssh.Dial(\"tcp\", host, cfg)\n\tif derr == nil {\n\t\tp = vfs.NewSSHPath(client, host, path, true)\n\t\treturn p.WriteFile(ctx, data, acl)\n\t}\n}\nreturn err","preventionTips":["Raise sshd MaxSessions on target hosts (each VFS op opens its own session)","Enable client-side SSH keepalives to survive NAT/firewall idle timeouts","Never share one ssh.Client across concurrent goroutines without a mutex","Re-dial the ssh.Client when errors mention session/channel problems","Ensure the account can open session channels (no restrictive ForceCommand)"],"tags":["ssh","sftp","vfs","network"],"backgroundTag":"ssh-session-open-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}