x/crypto/ssh: unable to authenticate if the first private key fails.

[lonnywong]

What version of Go are you using (go version)?

$ go version
go version go1.20.4 darwin/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/lonny/Library/Caches/go-build"
GOENV="/Users/lonny/Library/Application Support/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/lonny/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/lonny/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/Cellar/go/1.20.4/libexec"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.20.4/libexec/pkg/tool/darwin_amd64"
GOVCS=""
GOVERSION="go1.20.4"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="cc"
CXX="c++"
CGO_ENABLED="1"
GOMOD="/Users/lonny/workspace/test/go.mod"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/6l/jtqr77ms6rv21hw6ryq6zx3c0000gn/T/go-build1679388757=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

Add two private keys, the first one should fail, the second one should succeed.

package main

import (
	"fmt"
	"os"

	"golang.org/x/crypto/ssh"
)

func main() {
	var authMethods []ssh.AuthMethod
	addAuthKey := func(keyFilePath string) {
		keyBytes, err := os.ReadFile(keyFilePath)
		if err != nil {
			fmt.Fprintf(os.Stderr, "failed to read private key file %s: %s\r\n", keyFilePath, err)
			os.Exit(1)
		}
		signer, err := ssh.ParsePrivateKey(keyBytes)
		if err != nil {
			fmt.Fprintf(os.Stderr, "failed to parse private key file %s: %s\r\n", keyFilePath, err)
			os.Exit(1)
		}
		authMethods = append(authMethods, ssh.PublicKeys(signer))
	}

	user := "*** username ***"
	addr := "*** host:port ***"
	addAuthKey("/path/to/id_rsa")  // should fail
	addAuthKey("/path/to/id_ed25519")  // should succeed
	fmt.Printf("auth methods count: %d\r\n", len(authMethods))

	config := &ssh.ClientConfig{
		User:            user,
		Auth:            authMethods,
		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
	}

	if _, err := ssh.Dial("tcp", addr, config); err != nil {
		fmt.Fprintf(os.Stderr, "failed to connect to %s: %s\r\n", addr, err)
		os.Exit(1)
	}

	fmt.Printf("successfully connected to %s\n", addr)
}

• go.mod

module example.com/m/v

go 1.20

require golang.org/x/crypto v0.9.0

require golang.org/x/sys v0.8.0 // indirect

• go.sum

golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g=
golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=

What did you expect to see?

Successful connect to the SSH server using the second private key, not the first one.

What did you see instead?

ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
If I change the order of the two private keys, it succeeds.

[lonnywong]

My bad, suddenly found that the correct usage should be:

package main

import (
	"fmt"
	"os"

	"golang.org/x/crypto/ssh"
)

func main() {
	var signers []ssh.Signer
	addAuthKey := func(keyFilePath string) {
		keyBytes, err := os.ReadFile(keyFilePath)
		if err != nil {
			fmt.Fprintf(os.Stderr, "failed to read private key file %s: %s\r\n", keyFilePath, err)
			os.Exit(1)
		}
		signer, err := ssh.ParsePrivateKey(keyBytes)
		if err != nil {
			fmt.Fprintf(os.Stderr, "failed to parse private key file %s: %s\r\n", keyFilePath, err)
			os.Exit(1)
		}
		signers = append(signers, signer)
	}

	user := "*** username ***"
	addr := "*** host:port ***"
	addAuthKey("/path/to/id_rsa")  // should fail
	addAuthKey("/path/to/id_ed25519")  // should succeed
	fmt.Printf("signers count: %d\r\n", len(signers))

	config := &ssh.ClientConfig{
		User:            user,
		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signers...)},
		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
	}

	if _, err := ssh.Dial("tcp", addr, config); err != nil {
		fmt.Fprintf(os.Stderr, "failed to connect to %s: %s\r\n", addr, err)
		os.Exit(1)
	}

	fmt.Printf("successfully connected to %s\n", addr)
}