feat: make key authentication failures diagnosable

butterrobot commented

2026-09-09 19:58:08 +02:00

Member

A rejected key currently produces two generic 'Permission denied, please try again.' prompts and a denial listing every auth method — identical output whether the key input was malformed or just not authorized on the target. Validates the key with ssh-keygen before connecting (unusable input now fails immediately with the reason) and prints the derived public key, which is the exact line that must be in authorized_keys. Adds BatchMode=yes to stop the password fallback and IdentitiesOnly=yes so only the supplied key is offered. Follow-up to #1, from debugging fmartingr/fmartingr.com (FMG-7).

butterrobot added 1 commit

2026-09-09 19:58:08 +02:00

feat: verify the key up front and stop falling back to password auth bdc11a2f76

A rejected key produced two generic "Permission denied, please try again."
prompts followed by a denial listing every auth method, which says nothing
about why the key was refused, and looks identical whether the key input was
malformed or simply not authorized on the server.

The key is now checked with ssh-keygen before connecting, so an unusable
input fails immediately and says so, and the derived public key is printed —
that is the exact line that has to be present in authorized_keys.

BatchMode stops the interactive password fallback, and IdentitiesOnly keeps
ssh from offering anything other than the supplied key.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

butterrobot added 1 commit

2026-09-09 20:13:42 +02:00

feat: print the deploy key fingerprint aeb80c0565

sshd names the offered key by fingerprint at LogLevel VERBOSE, so emitting it
client-side makes a rejected key a direct comparison against the target's
auth log rather than a guess.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin +refs/pull/2/head:butterrobot/diagnose-key-auth-failures

git switch butterrobot/diagnose-key-auth-failures

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff butterrobot/diagnose-key-auth-failures

git switch butterrobot/diagnose-key-auth-failures

git rebase main

git switch main

git merge --ff-only butterrobot/diagnose-key-auth-failures

git switch butterrobot/diagnose-key-auth-failures

git rebase main

git switch main

git merge --no-ff butterrobot/diagnose-key-auth-failures

git switch main

git merge --squash butterrobot/diagnose-key-auth-failures

git switch main

git merge --ff-only butterrobot/diagnose-key-auth-failures

git switch main

git merge butterrobot/diagnose-key-auth-failures

git push origin main

Rows
Columns

feat: make key authentication failures diagnosable #2

Checkout

Merge