What causes "password rejected for %s" in ginuerzh/gost?

Verify the client's username and password against the server's configured authenticator source

password rejected for %s

Error message

password rejected for %s

What it means

This error is produced by the SSH server's password authentication callback when au.Authenticate(user, password) returns false. The server rejects the client's password attempt and closes the handshake with 'password rejected for <user>'. It is a server-side auth failure, not a network fault.

Source

Thrown at ssh.go:875

	}
	port, err = strconv.Atoi(portString)
	return
}

// PasswordCallbackFunc is a callback function used by SSH server.
// It authenticates user using a password.
type PasswordCallbackFunc func(conn ssh.ConnMetadata, password []byte) (*ssh.Permissions, error)

func defaultSSHPasswordCallback(au Authenticator) PasswordCallbackFunc {
	if au == nil {
		return nil
	}
	return func(conn ssh.ConnMetadata, password []byte) (*ssh.Permissions, error) {
		if au.Authenticate(conn.User(), string(password)) {
			return nil, nil
		}
		log.Logf("[ssh] %s -> %s : password rejected for %s", conn.RemoteAddr(), conn.LocalAddr(), conn.User())
		return nil, fmt.Errorf("password rejected for %s", conn.User())
	}
}

// PublicKeyCallbackFunc is a callback function used by SSH server.
// It offers a public key for authentication.
type PublicKeyCallbackFunc func(c ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error)

func defaultSSHPublicKeyCallback(keys map[string]bool) PublicKeyCallbackFunc {
	if len(keys) == 0 {
		return nil
	}

	return func(c ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {
		if keys[string(pubKey.Marshal())] {
			return &ssh.Permissions{
				// Record the public key used for authentication.
				Extensions: map[string]string{
					"pubkey-fp": ssh.FingerprintSHA256(pubKey),

View on GitHub (pinned to a33fdbf4c9)

Solutions

Verify the client's username and password against the server's configured authenticator source
Check server logs for the '[ssh] ... password rejected for <user>' line to confirm which user failed
Regenerate/update credentials and restart/reload the server authenticator
If public keys are intended, switch the client to key auth and configure PublicKeyCallbackFunc instead

Example fix

// server-side: ensure authenticator loads the right users
// before
au := auth.NewStaticAuthenticator(...list missing user...)
// after
au := auth.NewStaticAuthenticator("user", "correct-password", nil)

Defensive patterns

Strategy: validation

Validate before calling

// client-side: verify credentials before connecting
if user == "" || pass == "" {
    return errors.New("ssh password auth requires non-empty credentials")
}

Try / catch

client, err := ssh.Dial("tcp", addr, &ssh.ClientConfig{
    Auth: []ssh.AuthMethod{ssh.Password(pass)},
})
if err != nil {
    if strings.Contains(err.Error(), "password rejected") {
        return fmt.Errorf("check username/password for %s: %w", user, err)
    }
    return err
}

Prevention

Keep client credentials in sync with the server authenticator (file/env)
Check server logs for 'password rejected for <user>' to confirm the failing user
Rotate credentials atomically on both ends
Prefer key-based auth to avoid password mismatches

When it happens

Trigger: An SSH client attempts password authentication against a server built with PasswordCallbackFunc, and the configured authenticator (auth.Authenticate) does not accept the supplied username/password pair.

Common situations: Wrong password in client config; user not present in the server's auth file; authenticator misconfigured (wrong whitelist file path); credential rotation/typo after redeploy.

Related errors

AI-assisted analysis of ginuerzh/gost@a33fdbf4c9 (2026-09-02). Data as JSON: /api/errors/2f01cc80226ae156. Report an issue: GitHub.