{"record":{"id":"e0ad612b7c40df1e","repo":"wavetermdev/waveterm","slug":"no-identity-files-remaining","errorCode":null,"errorMessage":"no identity files remaining","messagePattern":"no identity files remaining","errorType":"error_code","errorClass":"ConnectionError","httpStatus":null,"severity":"error","filePath":"pkg/remote/sshclient.go","lineNumber":317,"sourceCode":"\tauthSockSigners = append(authSockSigners, authSockSignersExt...)\n\tauthSockSignersPtr := &authSockSigners\n\n\treturn func() (outSigner []ssh.Signer, outErr error) {\n\t\tdefer func() {\n\t\t\tpanicErr := panichandler.PanicHandler(\"sshclient:publickey-callback\", recover())\n\t\t\tif panicErr != nil {\n\t\t\t\toutErr = panicErr\n\t\t\t}\n\t\t}()\n\t\t// try auth sock\n\t\tif len(*authSockSignersPtr) != 0 {\n\t\t\tauthSockSigner := (*authSockSignersPtr)[0]\n\t\t\t*authSockSignersPtr = (*authSockSignersPtr)[1:]\n\t\t\treturn []ssh.Signer{authSockSigner}, nil\n\t\t}\n\n\t\tif len(*identityFilesPtr) == 0 {\n\t\t\treturn nil, ConnectionError{ConnectionDebugInfo: debugInfo, Err: fmt.Errorf(\"no identity files remaining\")}\n\t\t}\n\t\tidentityFile := (*identityFilesPtr)[0]\n\t\tblocklogger.Infof(connCtx, \"[conndebug] trying keyfile %q...\\n\", identityFile)\n\t\t*identityFilesPtr = (*identityFilesPtr)[1:]\n\t\tprivateKey, ok := existingKeys[identityFile]\n\t\tif !ok {\n\t\t\tlog.Printf(\"error with existingKeys, this should never happen\")\n\t\t\t// skip this key and try with the next\n\t\t\treturn createDummySigner()\n\t\t}\n\n\t\tunencryptedPrivateKey, err := ssh.ParseRawPrivateKey(privateKey)\n\t\tif err == nil {\n\t\t\tsigner, err := ssh.NewSignerFromKey(unencryptedPrivateKey)\n\t\t\tif err == nil {\n\t\t\t\tif utilfn.SafeDeref(sshKeywords.SshAddKeysToAgent) && agentClient != nil {\n\t\t\t\t\tagentClient.Add(agent.AddedKey{\n\t\t\t\t\t\tPrivateKey: unencryptedPrivateKey,","sourceCodeStart":299,"sourceCodeEnd":335,"githubUrl":"https://github.com/wavetermdev/waveterm/blob/a4447c1563b2df285ab89e76c82f91e1a1a49c1e/pkg/remote/sshclient.go#L299-L335","documentation":"The SSH public-key auth callback (createPublicKeyCallback signer iterator) returns this ConnectionError once it has exhausted both ssh-agent signers (auth sock) and configured identity key files. golang.org/x/crypto/ssh keeps invoking the callback for each offered auth method, so this error signals 'no more keys to try' rather than a single key failure. It surfaces when every candidate key has been consumed and the server still requests public-key auth.","triggerScenarios":"SSH connection where all auth-sock signers were offered and the last configured identity file was consumed; the server continues asking for public-key auth (key rejected/not authorized), so the callback has nothing left to return.","commonSituations":"Public key not in the remote's authorized_keys; wrong SshIdentityFile configured; key file unreadable (permissions) so it was skipped during preload leaving an empty list; no ssh-agent running and no keys present.","solutions":["Verify the remote's ~/.ssh/authorized_keys contains the public key corresponding to your private key.","Confirm SshIdentityFile points to a readable, valid private key (check [conndebug] log line 'trying keyfile').","Start ssh-agent and add your key (ssh-add), or use an agent so signers are available.","Enable password or keyboard-interactive auth so another method can succeed after keys are exhausted.","If the key is passphrase-protected, make sure the passphrase prompt isn't disabled by SshBatchMode."],"exampleFix":"// before (config)\nconnection: { \"sshidentityfile\": [\"~/.ssh/nonexistent_key\"] }\n// after\nconnection: { \"sshidentityfile\": [\"~/.ssh/id_ed25519\"] } // readable key whose pubkey is on the server","handlingStrategy":"fallback","validationCode":"// before connecting, check the key exists and is readable\nif _, err := os.Stat(identityFile); err != nil {\n    return fmt.Errorf(\"identity file %s missing/unreadable: %w\", identityFile, err)\n}","typeGuard":null,"tryCatchPattern":"var ce ConnectionError\nif err := Connect(...); err != nil {\n    if errors.As(err, &ce) && strings.Contains(ce.Error(), \"no identity files remaining\") {\n        // fall back to password / keyboard-interactive auth or fix key config\n    }\n}","preventionTips":["Ensure at least one valid identity file is configured and readable.","Run ssh-agent with keys loaded so the auth-sock path has signers.","Verify the public key is installed in the remote's authorized_keys.","Leave password/kbd-interactive auth enabled as a secondary method.","Read the [conndebug] logs to see which keyfiles were attempted."],"tags":["ssh","authentication","publickey"],"backgroundTag":"ssh-auth-failed","analyzedSha":"a4447c1563b2df285ab89e76c82f91e1a1a49c1e","analyzedAt":"2026-09-01T15:26:23.972Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}