ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain

The bracketed list reflects the `Auth` methods you configured. `[none]` alone means the client had no usable method at all — typically an empty `Auth` slice or a key that failed to load.

golang.org/x/crypto/ssh (Go) — ssh.Dial / ssh.NewClientConn

What it means

The SSH transport was established (host key accepted), but every authentication method the client tried was rejected and the server offered nothing else the client could do. The list in brackets is what the Go client attempted: `none` is the initial probe every SSH client sends, `publickey` means your keys were offered and refused. This is the Go equivalent of OpenSSH's "Permission denied (publickey)".

Why it happens

• The key is not in the server's authorized_keys

  common

  The program uses a different key than the one installed on the server (another file, another environment's secret), or the key was added for a different user.

• No usable auth method was configured

  common

  An empty `Auth` slice, a signer that failed to load and was silently skipped, or an `ssh.PublicKeysCallback` backed by an SSH agent that holds no keys.

• RSA key signed with ssh-rsa (SHA-1)

  occasional

  OpenSSH 8.8+ servers reject `ssh-rsa` signatures. Old x/crypto versions sign RSA keys with SHA-1 by default; current versions negotiate `rsa-sha2-256/512`. Upgrade golang.org/x/crypto or use an Ed25519 key.

• Wrong remote user

  occasional

  The key is authorized for `ubuntu` but the client logs in as `root` or `deploy`. Authorization is per user.

How to fix it

1. 1.

   Load the key explicitly and verify the host

   Read the private key, fail loudly if parsing fails, and use `knownhosts` for the host key instead of `ssh.InsecureIgnoreHostKey()`.

   keyBytes, err := os.ReadFile(os.ExpandEnv("$HOME/.ssh/id_ed25519"))
   if err != nil {
   	return err
   }
   signer, err := ssh.ParsePrivateKey(keyBytes)
   if err != nil {
   	return err
   }
   hostKeys, err := knownhosts.New(os.ExpandEnv("$HOME/.ssh/known_hosts"))
   if err != nil {
   	return err
   }
   client, err := ssh.Dial("tcp", "server.example.com:22", &ssh.ClientConfig{
   	User:            "deploy",
   	Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
   	HostKeyCallback: hostKeys,
   })

2. 2.

   Compare fingerprints and read the server log

   sshd logs why it refused a key (bad permissions on `~/.ssh`, algorithm not accepted, unknown user). The client side never learns the reason.

   ssh-keygen -lf ~/.ssh/id_ed25519.pub                 # fingerprint of the key the program uses
   ssh deploy@server.example.com 'ssh-keygen -lf ~/.ssh/authorized_keys'
   sudo journalctl -u ssh -n 20                         # sshd's reason (modes, algorithms, user)

← Browse the full signature error database