Skip to content

Commit 833cf5a

Browse files
authored
Fix SSH auth failures by enforcing IdentitiesOnly=yes (#4095)
## Changes I faced this issue myself when trying the expermental ssh tunnel. since I have couple of keys loaded into my ssh-agent When a specific ssh key is provided via `-i` or IdentityFile option,the SSH client still attempt to auth using all keys loaded in the ssh-agent first. If too many keys are loaded, this causes the server to reject the connection with "Too many authentication failures" before the correct key is attempted. ## Why <!-- Why are these changes needed? Provide the context that the reviewer might be missing. For example, were there any decisions behind the change that are not reflected in the code itself? --> ## Tests manually tested the change <!-- If your PR needs to be included in the release notes for next release, add a separate entry in NEXT_CHANGELOG.md as part of your PR. -->
1 parent 56fc0db commit 833cf5a

File tree

2 files changed

+2
-0
lines changed

2 files changed

+2
-0
lines changed

experimental/ssh/internal/client/client.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,7 @@ func spawnSSHClient(ctx context.Context, userName, privateKeyPath string, server
252252
sshArgs := []string{
253253
"-l", userName,
254254
"-i", privateKeyPath,
255+
"-o", "IdentitiesOnly=yes",
255256
"-o", "StrictHostKeyChecking=accept-new",
256257
"-o", "ConnectTimeout=360",
257258
"-o", "ProxyCommand=" + proxyCommand,

experimental/ssh/internal/setup/setup.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@ Host %s
9696
User root
9797
ConnectTimeout 360
9898
StrictHostKeyChecking accept-new
99+
IdentitiesOnly yes
99100
IdentityFile %q
100101
ProxyCommand %s
101102
`, opts.HostName, identityFilePath, proxyCommand)

0 commit comments

Comments
 (0)