crowdsecurity/crowdsec · error

machine %s attempted to auth with password but it is configu

Error message

machine %s attempted to auth with password but it is configured to use %s

What it means

authPlain resolved the machine in the DB, but its stored auth_type is not 'password', so password login is refused. CrowdSec pins each machine to the auth method it was registered with (password vs tls) to prevent downgrade/upgrade confusion.

Source

Thrown at pkg/apiserver/middlewares/v1/jwt.go:161

	ret.machineID = *loginInput.MachineID
	password := *loginInput.Password
	ret.scenariosInput = loginInput.Scenarios

	ret.clientMachine, err = j.DbClient.Ent.Machine.Query().
		Where(machine.MachineId(ret.machineID)).
		First(ctx)
	if err != nil {
		log.Infof("Error machine login for %s : %+v ", ret.machineID, err)
		return nil, err
	}

	if ret.clientMachine == nil {
		log.Errorf("Nothing for '%s'", ret.machineID)
		return nil, jwt.ErrFailedAuthentication
	}

	if ret.clientMachine.AuthType != types.PasswordAuthType {
		return nil, fmt.Errorf("machine %s attempted to auth with password but it is configured to use %s", ret.machineID, ret.clientMachine.AuthType)
	}

	if !ret.clientMachine.IsValidated {
		return nil, fmt.Errorf("machine %s not validated", ret.machineID)
	}

	if err := bcrypt.CompareHashAndPassword([]byte(ret.clientMachine.Password), []byte(password)); err != nil {
		return nil, jwt.ErrFailedAuthentication
	}

	return &ret, nil
}

func (j *JWT) Authenticator(c *gin.Context) (any, error) {
	var (
		err  error
		auth *authInput
	)

View on GitHub (pinned to 909b515798)

Solutions

1. Re-register the machine for password auth: cscli machines delete <machineID> && cscli machines add <machineID> --password <pw>
2. Or switch the client back to TLS cert auth instead of using local_api_credentials.yaml
3. Standardize enrollment in your automation: pick password OR tls per machine and never mix
4. Check 'cscli machines list' — the Auth Type column shows what the server expects

Example fix

// before: machine exists with tls auth, client uses password creds
// on LAPI host:
cscli machines delete myagent
cscli machines add myagent --password 'S3cret' --force
// then on the agent, regenerate local_api_credentials.yaml

// confirm the machine's auth type before using password credentials
out, _ := exec.Command("cscli", "machines", "list", "-o", "json").Output()
var machines []struct {
    MachineID string `json:"machineId"`
    AuthType  string `json:"authType"`
}
json.Unmarshal(out, &machines)
for _, m := range machines {
    if m.MachineID == "myagent" && m.AuthType != "password" {
        log.Fatalf("machine %s uses %s auth; password login will be refused", m.MachineID, m.AuthType)
    }
}

_, err := client.Login(ctx)
if err != nil && strings.Contains(err.Error(), "attempted to auth with password") {
    return fmt.Errorf("machine is cert-registered; use TLS auth or re-enroll with password: %w", err)
}

When it happens

Trigger: Authenticator -> authPlain: correct machine_id/password lookup succeeds but ret.clientMachine.AuthType != types.PasswordAuthType — the machine row was created via TLS auto-registration, and the client now tries password credentials (e.g. api client credentials in config pointing at a cert-enrolled machine).

Common situations: Agent was enrolled with 'cscli machines add --interactive' with certs or auto-registered via TLS, then local_api_credentials.yaml is used to log in with a password; config management flips the agent from cert auth back to password auth; copying credentials between hosts.

Related errors

• machine %s attempted to auth with TLS cert but it is configu
• machine '%s': %w
• path must start with /
• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/17462dcd963e2bc6. Report an issue: GitHub.