slackhq/nebula · error

invalid sshd.listen address: %s

Error message

invalid sshd.listen address: %s

What it means

configSSH parses sshd.listen with net.SplitHostPort to extract the port. If the value is not a well-formed host:port address, SplitHostPort fails and the error is wrapped as "invalid sshd.listen address". This guards against malformed listen strings before any socket is opened.

Source

Thrown at ssh.go:89

		} else {
			ssh.Stop()
		}
	})
}

// configSSH reads the ssh info out of the passed-in Config and
// updates the passed-in SSHServer. On success, it returns a function
// that callers may invoke to run the configured ssh server. On
// failure, it returns nil, error.
func configSSH(l *slog.Logger, ssh *sshd.SSHServer, c *config.C) (func(), error) {
	listen := c.GetString("sshd.listen", "")
	if listen == "" {
		return nil, fmt.Errorf("sshd.listen must be provided")
	}

	_, port, err := net.SplitHostPort(listen)
	if err != nil {
		return nil, fmt.Errorf("invalid sshd.listen address: %s", err)
	}
	if port == "22" {
		return nil, fmt.Errorf("sshd.listen can not use port 22")
	}

	hostKeyPathOrKey := c.GetString("sshd.host_key", "")
	if hostKeyPathOrKey == "" {
		return nil, fmt.Errorf("sshd.host_key must be provided")
	}

	var hostKeyBytes []byte
	if strings.Contains(hostKeyPathOrKey, "-----BEGIN") {
		hostKeyBytes = []byte(hostKeyPathOrKey)
	} else {
		hostKeyBytes, err = os.ReadFile(hostKeyPathOrKey)
		if err != nil {
			return nil, fmt.Errorf("error while loading sshd.host_key file: %s", err)
		}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Use a host:port form such as "0.0.0.0:2222"; bracket IPv6 hosts: "[::1]:2222".
2. Test the value with net.SplitHostPort locally before deploying.
3. Trim whitespace and remove surrounding quotes from the config value.

Example fix

// before
sshd.listen = "0.0.0.0"
// after
sshd.listen = "0.0.0.0:2222"

raw := cfg.GetString("sshd.listen", "")
if _, _, err := net.SplitHostPort(raw); err != nil {
    return fmt.Errorf("sshd.listen %q must be host:port (bracket IPv6: [::1]:2222)", raw)
}

run, err := configSSH(logger, srv, c)
if err != nil {
    if strings.Contains(err.Error(), "invalid sshd.listen address") {
        logger.Error("bad sshd.listen, want host:port", "value", c.GetString("sshd.listen", ""))
        os.Exit(78)
    }
    return err
}

When it happens

Trigger: Setting sshd.listen to something without a port ("0.0.0.0"), with too many colons ("host:1:2" unbracketed), or a bare port number ("2222"), so net.SplitHostPort returns an error in ssh.go's configSSH.

Common situations: IPv6 addresses written unbracketed ("::1:2222"); missing the port entirely; copying a systemd-style listen directive that SplitHostPort cannot parse; stray whitespace or quotes inside the value.

Related errors

• sshd.listen must be provided
• sshd.listen can not use port 22
• sshd.host_key must be provided
• error while loading sshd.host_key file: %s
• error while adding sshd.host_key: %s

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/d1961b18c2a108dd. Report an issue: GitHub.