Cloud / SRE
Fixing Too Many Authentication Failures in an iTerm SSH Profile
Why an SSH agent can exhaust MaxAuthTries before the intended key is offered, and how IdentitiesOnly and IdentityAgent fix the profile.
On this page
An iTerm SSH profile that used to work can suddenly close immediately after launch. If the terminal also prints OpenSSH’s post-quantum key exchange warning, it is easy to chase the wrong problem and assume the server-side SSH version is broken.
The real error to look for is usually:
Too many authentication failures
This happens when the local machine has an SSH agent, 1Password SSH Agent, or many private keys loaded. The SSH client may offer several agent keys before it reaches the key specified by -i. The server can limit authentication attempts with MaxAuthTries, so it may disconnect before the intended key is tried.[2]
Terms used here
| Term | Meaning |
|---|---|
| SSH agent | A local process that stores private keys and offers them to SSH clients. |
| 1Password SSH Agent | 1Password’s SSH agent integration. It can make keys available to SSH without writing them as plain files. |
IdentitiesOnly=yes | SSH option that tells the client to use only the identities explicitly configured for this command or host. |
IdentityAgent=none | SSH option that disables the local agent for this connection. |
| Post-quantum key exchange warning | A security notice about future-safe key exchange algorithms. It is separate from authentication failure. |
The useful test is to compare these two commands:
ssh -i "/path/to/key.pem" user@private-host
and:
ssh -o IdentitiesOnly=yes -o IdentityAgent=none -i "/path/to/key.pem" user@private-host
If the second command works, the network path and server are fine. The failure was caused by unintended identities being offered first.
The durable profile command is:
ssh -o IdentitiesOnly=yes -o IdentityAgent=none -i "/path/to/key.pem" user@private-host
IdentitiesOnly=yes tells SSH to use only explicitly configured identities. IdentityAgent=none disables the authentication agent for that connection.[1]
The post-quantum warning is a separate security notice. It may be worth addressing as part of server hardening, but it was not the reason this profile failed to log in.
References
[1] OpenBSD. “ssh_config(5): IdentitiesOnly and IdentityAgent.”