phacility/phabricator · error · Exception

Can not generate keys: unable to find "%s" in PATH!

Error message

Can not generate keys: unable to find "%s" in PATH!

What it means

Phabricator generates SSH keypairs for users (Settings → SSH Public Keys → Generate Key) by shelling out to the 'ssh-keygen' binary. assertCanGenerateKeypair() first checks that the binary is resolvable in the web-server/daemon process's PATH via Filesystem::resolveBinary(), and throws this exception when it is not found. It is an environment/setup problem, not a code problem.

Source

Thrown at src/infrastructure/util/PhabricatorSSHKeyGenerator.php:8

<?php

final class PhabricatorSSHKeyGenerator extends Phobject {

  public static function assertCanGenerateKeypair() {
    $binary = 'ssh-keygen';
    if (!Filesystem::resolveBinary($binary)) {
      throw new Exception(
        pht(
          'Can not generate keys: unable to find "%s" in PATH!',
          $binary));
    }
  }

  public static function generateKeypair() {
    self::assertCanGenerateKeypair();

    $tempfile = new TempFile();
    $keyfile = dirname($tempfile).DIRECTORY_SEPARATOR.'keytext';

    execx(
      'ssh-keygen -t rsa -N %s -f %s',
      '',
      $keyfile);

    $public_key = Filesystem::readFile($keyfile.'.pub');

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Install openssh-client on the host that runs PHP: 'apt-get install openssh-client' (Debian/Ubuntu) or 'yum install openssh-clients' (RHEL/CentOS).
2. Verify the PHP process itself can find it: 'sudo -u www-data php -r \"echo Filesystem::resolveBinary('ssh-keygen');\"' or check 'ssh-keygen' is in /usr/bin and that directory is in the pool's PATH.
3. Restart PHP-FPM / the web server after installing so the new PATH takes effect.
4. Alternatively let users upload existing public keys instead of using key generation.

// Probe key generation ability ahead of the UI flow and degrade gracefully:
$can_generate = false;
try {
  PhabricatorSSHKeyGenerator::assertCanGenerateKeypair();
  $can_generate = true;
} catch (Exception $e) {
  // ssh-keygen unavailable; hide the 'Generate Key' action
}
// Use $can_generate to decide whether to render the generate-key button.

// Catch around the generation call and surface a setup message instead of a stack trace:
try {
  $result = PhabricatorSSHKeyGenerator::generateKeypair();
} catch (Exception $e) {
  if (strpos($e->getMessage(), 'ssh-keygen') !== false) {
    return $this->newDialog()->setTitle(pht('SSH Keygen Unavailable'))
      ->appendParagraph(pht('Install openssh-client on the web host.'));
  }
  throw $e;
}

When it happens

Trigger: A user clicks 'Generate Key' in Settings → SSH Public Keys, or any code path calls PhabricatorSSHKeyGenerator::generateKeypair(), on a host where the PHP process cannot find 'ssh-keygen' — typically because openssh-client is not installed or the web server's PATH is minimal (e.g. /usr/bin:/bin missing, chroot, systemd service with restricted PATH).

Common situations: New Phabricator install where openssh-client was never installed; PHP-FPM pool with a stripped-down PATH; running under a container or chroot that omits ssh-keygen; Phacility/daemon hosts provisioned without SSH tooling.

Related errors

• Before you can set up or use LDAP, you need to install the P
• Analyzing or decrypting SSH keys requires the "ssh-keygen" b
• Keyring is configured with a "%s" key, but the PHP OpenSSL e
• Unable to imagesavealpha() a new empty image: %s
• Unable to imagecolorallocatealpha() a new empty image: %s

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/6106189a3f2c6260. Report an issue: GitHub.