pentaho/pentaho-kettle · error · SshAuthenticationException

SSH authentication failed

Error message

SSH authentication failed

What it means

authenticateSession throws SshAuthenticationException('SSH authentication failed') after neither public key nor password authentication succeeded. The server rejected every configured credential method. This happens after TCP connect succeeded, so it is purely a credentials/authorization issue.

Solutions

1. Verify username/password by logging in manually with ssh
2. Confirm the private key corresponds to an entry in ~/.ssh/authorized_keys on the server
3. Enable debug logging to see which auth methods were attempted
4. Check sshd_config: ensure PasswordAuthentication or PubkeyAuthentication is enabled for the chosen method
5. Verify the user account is active (not expired/locked: chage -l, passwd -S)

Example fix

// before
config.setPassword( "pass" ); // stale password after rotation
// after
config.setPassword( System.getenv( "SSH_PASSWORD" ) ); // current, from secure source

// pre-validate credentials before running the job
Process p = new ProcessBuilder( "ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=5",
    user + "@" + host, "true" ).start();
boolean ok = p.waitFor() == 0; // non-zero => credentials/method unusable

try { conn.connect(); }
catch ( SshAuthenticationException e ) {
  log.error( "Auth rejected for user {} on {}: check password/authorized_keys", user, host );
  // do NOT blindly retry — triggers fail2ban/MaxAuthTries
}

When it happens

Trigger: connect() reaches authenticateSession; tryPublicKeyAuthentication returns false or throws, and tryPasswordAuthentication also fails/returns false — e.g. wrong password, wrong key, or user not permitted.

Common situations: Wrong password stored in job metadata; private key not matching the server's authorized_keys; PasswordAuthentication disabled on server while key is unconfigured; user locked or shell disabled.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to load SSH key
• Failed to parse SSH key content
• Password authentication failed
• SalesforceInput.Error.InvalidUsernameOrPassword
• SFTPPUT.Error.Connection

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/3b565e3137247d11. Report an issue: GitHub.

Appendix: source

Thrown at engine/src/main/java/org/pentaho/di/core/ssh/mina/MinaSshConnection.java:294

    if ( s == null ) {
      throw new SshConnectionException( "SSH connection failed - session is null" );
    }

    return s;
  }

  private void authenticateSession() throws SshConnectionException {
    log( DEBUG, "Starting SSH authentication - Auth type: " + config.getAuthType() );
    boolean authed = tryPublicKeyAuthentication();

    if ( !authed ) {
      log( DEBUG, "Public key authentication failed or not configured, trying password authentication" );
      authed = tryPasswordAuthentication();
    }

    if ( !authed ) {
      log( ERROR, "All SSH authentication methods failed" );
      throw new SshAuthenticationException( "SSH authentication failed" );
    } else {
      log( BASIC, "SSH authentication successful" );
    }
  }

  private boolean tryPublicKeyAuthentication() throws SshAuthenticationException {
    if ( config.getAuthType() != SshConfig.AuthType.PUBLIC_KEY ) {
      log( DEBUG, "Skipping public key authentication - not configured" );
      return false;
    }

    log( DEBUG, "Attempting SSH public key authentication" );

    try {
      KeyPairProvider keyPairProvider = loadKeyPairProvider();
      if ( keyPairProvider == null ) {
        return false;
      }

View on GitHub (pinned to f3058517a1)