Pearson's OSCP Notebook

SSH Errors

Properties1
tagsssh, ssh-errors, identitiesonly, id_rsa, permissions, authentication, oscp

3 min read

SSH Errors — Troubleshooting

Ctrl+F: Too many authentication failures · IdentitiesOnly · Permissions.*too open · id_rsa · chmod 600

Common SSH client errors on OSCP when the key, user, or auth order is almost right — fix with the flags below.

→ SSH (full reference) · SSH Tunneling

Too many authentication failures

Error

Received disconnect from X.X.X.X port 22:2: Too many authentication failures
Disconnected from X.X.X.X port 22

Or similar when connecting with -i id_rsa — before you even get a password prompt.

Cause

OpenSSH tries every private key in ~/.ssh/ (and ssh-agent) before the key you specified with -i. If you have many keys in a keys/ folder (or ~/.ssh/), the server may disconnect after ~6 failed pubkey attempts — even when the correct key is in the list.

Common when:

  • ~/.ssh/ or a custom keys/ directory has 4+ private keys
  • You use ssh -i one_key user@target but SSH still offers other keys first

Reference: Server Fault — Too many authentication failures

Fix — IdentitiesOnly=yes

Tell SSH to use only the identity file you pass with -i (or config), not every key in the agent/folder:

ssh -i id_rsa -o IdentitiesOnly=yes root@10.10.10.10
ssh -i /path/to/keys/root_key -o IdentitiesOnly=yes root@192.168.234.165

Full example (root with specific key):

ssh -i id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no root@TARGET

Permanent fix — ~/.ssh/config

Host target-box
    HostName 10.10.10.10
    User root
    IdentityFile ~/.ssh/keys/root_key
    IdentitiesOnly yes
    StrictHostKeyChecking no

ssh target-box

Other mitigations

# Force only publickey auth with your key
ssh -o PreferredAuthentications=publickey -o IdentitiesOnly=yes -i id_rsa user@TARGET
 
# Temporarily unload keys from ssh-agent
ssh-add -D
ssh -i id_rsa user@TARGET
FlagEffect
IdentitiesOnly=yesOnly use -i / IdentityFile keys — fix for too many auth failures
PreferredAuthentications=publickeySkip password after pubkey attempts
PubkeyAuthentication=yesEnsure key auth is enabled

id_rsa — Permissions are too open

Error

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
Permissions 0644 for 'id_rsa' are too open.
It is required that your private key files are NOT accessible by others.

Or:

Load key "id_rsa": bad permissions

Cause

Private key file or ~/.ssh/ directory is world-readable or group-readable. OpenSSH refuses to use loose private keys.

Fix

chmod 600 id_rsa
chmod 644 id_rsa.pub          # public key — can be readable
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys   # on target, if editing

Then reconnect:

ssh -i id_rsa -o IdentitiesOnly=yes user@TARGET

Required permissions (quick reference)

File / dirMode
Private key (id_rsa, id_ed25519)600
Public key (id_rsa.pub)644
~/.ssh/ directory700

→ Full key auth section: SSH > Method 2 — Private Key Authentication (`id_rsa`)

Combined — looted key still won’t connect

Checklist when ssh -i id_rsa user@target fails:

# 1. Fix permissions
chmod 600 id_rsa
 
# 2. Only offer this key (too many auth failures)
ssh -i id_rsa -o IdentitiesOnly=yes user@TARGET
 
# 3. Lab / CTF — skip host key prompt
ssh -i id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null user@TARGET
 
# 4. Verbose — see which keys are tried
ssh -vvv -i id_rsa -o IdentitiesOnly=yes user@TARGET

Passphrase on key? → SSH > Method 5 — Cracking a Passphrase-Protected Key · ssh2john

Quick cheat sheet

# Too many authentication failures
ssh -i id_rsa -o IdentitiesOnly=yes root@TARGET
 
# Permissions too open
chmod 600 id_rsa && ssh -i id_rsa -o IdentitiesOnly=yes user@TARGET
 
# Both issues + ignore host key (OSCP)
chmod 600 id_rsa
ssh -i id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no user@TARGET

Graph View

Backlinks