Remote SSH: Can not connect to host requiring certificate for authentication (error resolving authority)

[jemus42]

System details:

macOS 15.3 (24D60)

Positron and OS details:

Positron Version: 2025.02.0 (Universal) build 137 Code - OSS Version: 1.96.0 Commit: f4b7966cfa58aa954daafddfe04297e9f3680412 Date: 2025-01-30T15:14:42.529Z Electron: 32.2.6 Chromium: 128.0.6613.186 Node.js: 20.18.1 V8: 12.8.374.38-electron.0 OS: Darwin arm64 24.3.0

Interpreter details:

R 4.4.2

Describe the issue:

I am trying to connect to a remote host which requires a certificate in addition to an SSH key. My .ssh/config has an entry like this

Host foobar
  HostName foo.bar.edu
  User myuser
  IdentityFile ~/.ssh/id_ecdsa

And I have an id_ecdsa + id_ecdsa-cert.pub keypair. I can ssh into the host without issues and VSCode can do its Remote SSH thing as well.

When I try to connect to this host with Positron, I encounter authentication errors akin to when one tries to ssh into a host for which one does not have the correct key installed. The output window shows ssh connection details including what looks like an attempt to to use my id_ecdsa key

Pardon the 99% superfluous blurring of presumably just public key fingerprints

Since I do not control the host I am unfortunately not sure how I could reproduce this setup in a test environment.

Steps to reproduce the issue:

1. Try to connect to remote host using authentication setup as described? (Apologies but I do not now how to reproduce this in an isolate fashion)

Expected or desired behavior:

Positron connecting to and setting up the remote host as it does for other hosts.

Were there any error messages in the UI, Output panel, or Developer Tools console?

See screenshot above. I have failed to find a way to copy the log so far as the modal window blocks the UI.

[jmcphers]

Host foobar
  HostName foo.bar.edu

I notice that the error in the screenshot is error resolving authority which may just indicate a hostname resolution error (vs a cert/auth problem).

• Does it work if you give Positron the full hostname [email protected] instead of using the short form foobar?
• Are you able to connect to hosts defined this way that do not use cert based auth?

[jemus42]

From what I understand foobar is just the short form alias of the host but connections are made using HostName(specified as a FQDN) in any case? For what it's worth, I can connect to this host just fine with ssh and the HostName resolves using dig just fine as well

• Does it work if you give Positron the full hostname [email protected] instead of using the short form foobar?

Changing foo to the FQDN foo.bar.edu did not change the behavior, or what do you mean? Since Positron lists the SSH targets from my .ssh/config file I'm not sure where else to supply any further details when connecting via Positron, and since the host config already contains a username and FQDN I'm not sure what to do differently?

• Are you able to connect to hosts defined this way that do not use cert based auth?

Yes, this works via ssh foo in the terminal and via the VSCode Remote SSH extension just normally, both for this host and for various other hosts defined in my .ssh/config file this way. From what I can gather, it's only Positron that can not connect to this host.

Does Positron's Remote SSH mechanism bundle it's own ssh or do anything in particular around the connection that would interfere with authentication?

[jmcphers]

Try running the command Remote-SSH: Connect to Host from the Palette. You'll see this:

Enter [email protected] in that prompt. Does that address the issue, or give you a different error?

[jemus42]

Ah, I totally forgot that was even an option, sorry!

Yes, when I try that the behavior is exactly the same. The only difference of course being the first line

Resolving ssh remote authority '[email protected]' (attemp #1)

Instead of

Resolving ssh remote authority 'ssh-remote+foobar' (attemp #1)

I can also see that it's trying the ed25519 key, but shouldn't my .ssh/config ensure that only the ecdsa key is being used? Presumably that doesn't affect the resolution issue but I'm wondering if (parts of) the config are ignore or misinterpreted?

[jmcphers]

Okay, thanks, that's helpful!

I think what you're seeing is an issue with the Open Remote SSH extension we're using, which is also responsible for lots of reports of this issue in Cursor. See here for lots more details: https://github.com/getcursor/cursor/issues/1027.

Do any of the workarounds in that issue help?

[jemus42]

Ah too bad, but oh well, will watch that other issue as well just in case, thanks!

There were two workarounds stated in https://github.com/getcursor/cursor/issues/1027#issuecomment-2454651328, so for anyone else running into this here:

1. (macOS): Give Full Disk Access permission to Cursor (->Positron) -> Tried it, didn't work.
2. Delete ~/.cursor_server on the remote host -> There's no .positron_server on the remote host or anything as I never connected to it (with Positron) yet, only ~/.vscode_server which of course I assume to be unrelated -> Not applicable

The linked issue notes the error message Error: All configured authentication methods failed though which is kind of related but different from what I'm seeing though 🤷‍♂

[juliasilge]

I'm not sure if you have the bandwidth for this, but if you are able to test out connecting to a session with VSCodium and the open-remote-ssh extension, we are wondering if you see the same error.

[jemus42]

Sure! This issue is the only thing blocking me from going all-in on Positron for my R projects, so I'm happy to do all the debugging things you can think of if it helps 😁

Here's what I get in VSCodium with open-remote-ssh v0.0.48:

[Info  - 12:30:54.765] Resolving ssh remote authority 'ssh-remote+foo' (attemp #1)
[Trace  - 12:30:54.780] Identity keys:
Lukas@dufte ssh-ed25519 SHA256:m3CfNF/UTtpkO/srgC4RmPGd9qQ0923v+bqYeQogN6c=
/Users/Lukas/.ssh/id_ecdsa ecdsa-sha2-nistp256 SHA256:W6FX9Wdw2XhSyoV5yMHLxPKjAyY8DRKcLu3GCG94nkc=
[Info  - 12:30:56.121] Trying no-auth authentication
[Info  - 12:30:56.451] Trying publickey authentication: Lukas@dufte ssh-ed25519 SHA256:m3CfNF/UTtpkO/srgC4RmPGd9qQ0923v+bqYeQogN6c=
[Info  - 12:30:56.875] Trying publickey authentication: /Users/Lukas/.ssh/id_ecdsa ecdsa-sha2-nistp256 SHA256:W6FX9Wdw2XhSyoV5yMHLxPKjAyY8DRKcLu3GCG94nkc=
[Error  - 12:30:57.309] Error resolving authority
Error: All configured authentication methods failed
	at me (/Users/Lukas/.vscode-oss/extensions/jeanp413.open-remote-ssh-0.0.48-universal/out/extension.js:1:155776)
	at /Users/Lukas/.vscode-oss/extensions/jeanp413.open-remote-ssh-0.0.48-universal/out/extension.js:1:409435
	at authHandler (/Users/Lukas/.vscode-oss/extensions/jeanp413.open-remote-ssh-0.0.48-universal/out/extension.js:1:404812)
	at Se (/Users/Lukas/.vscode-oss/extensions/jeanp413.open-remote-ssh-0.0.48-universal/out/extension.js:1:158994)
	at USERAUTH_FAILURE (/Users/Lukas/.vscode-oss/extensions/jeanp413.open-remote-ssh-0.0.48-universal/out/extension.js:1:147797)
	at 51 (/Users/Lukas/.vscode-oss/extensions/jeanp413.open-remote-ssh-0.0.48-universal/out/extension.js:1:311810)
	at e.exports.M (/Users/Lukas/.vscode-oss/extensions/jeanp413.open-remote-ssh-0.0.48-universal/out/extension.js:1:178339)
	at H.decrypt (/Users/Lukas/.vscode-oss/extensions/jeanp413.open-remote-ssh-0.0.48-universal/out/extension.js:1:274675)
	at e.exports.F [as _parse] (/Users/Lukas/.vscode-oss/extensions/jeanp413.open-remote-ssh-0.0.48-universal/out/extension.js:1:177863)
	at e.exports.parse (/Users/Lukas/.vscode-oss/extensions/jeanp413.open-remote-ssh-0.0.48-universal/out/extension.js:1:182250)
	at Socket.<anonymous> (/Users/Lukas/.vscode-oss/extensions/jeanp413.open-remote-ssh-0.0.48-universal/out/extension.js:1:154516)
	at Socket.emit (node:events:518:28)
	at Socket.emit (node:domain:489:12)
	at addChunk (node:internal/streams/readable:561:12)
	at readableAddChunkPushByteMode (node:internal/streams/readable:512:3)
	at Readable.push (node:internal/streams/readable:392:5)
	at TCP.onStreamRead (node:internal/stream_base_commons:191:23)

And here's Positron (2025.02.0 (Universal) build 137 Code - OSS Version: 1.96.0) again for comparison:

[Info  - 12:33:36.642] Resolving ssh remote authority 'ssh-remote+foo' (attemp #1)
[Trace  - 12:33:36.667] Identity keys:
Lukas@dufte ssh-ed25519 SHA256:m3CfNF/UTtpkO/srgC4RmPGd9qQ0923v+bqYeQogN6c=
/Users/Lukas/.ssh/id_ecdsa ecdsa-sha2-nistp256 SHA256:W6FX9Wdw2XhSyoV5yMHLxPKjAyY8DRKcLu3GCG94nkc=
[Info  - 12:33:37.593] Trying no-auth authentication
[Info  - 12:33:37.912] Trying publickey authentication: Lukas@dufte ssh-ed25519 SHA256:m3CfNF/UTtpkO/srgC4RmPGd9qQ0923v+bqYeQogN6c=
[Info  - 12:33:38.255] Trying publickey authentication: /Users/Lukas/.ssh/id_ecdsa ecdsa-sha2-nistp256 SHA256:W6FX9Wdw2XhSyoV5yMHLxPKjAyY8DRKcLu3GCG94nkc=
[Error  - 12:33:38.731] Error resolving authority
Error: All configured authentication methods failed
	at mt (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:160854)
	at /Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:407773
	at authHandler (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:403150)
	at St (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:164072)
	at USERAUTH_FAILURE (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:152875)
	at 51 (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:309500)
	at t.exports.M (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:183417)
	at R.decrypt (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:276148)
	at t.exports.F [as _parse] (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:182941)
	at t.exports.parse (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:187433)
	at Socket.<anonymous> (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:159594)
	at Socket.emit (node:events:518:28)
	at Socket.emit (node:domain:489:12)
	at addChunk (node:internal/streams/readable:561:12)
	at readableAddChunkPushByteMode (node:internal/streams/readable:512:3)
	at Readable.push (node:internal/streams/readable:392:5)
	at TCP.onStreamRead (node:internal/stream_base_commons:191:23)

[juliasilge]

Yep, that definitely looks like the same error, which is sort of a good news / bad news situation, I guess! We will make plans to prioritize working on this problem.

[apcamargo]

I've been experiencing the same bug here for some time now. Let me know if there's any information I can provide to help with this.

[juliasilge]

Reported again in:

• #6891
• #6942

[yassineS]

+1 I am facing the same issue. The annoying thing is that in an earlier version of Positron, unfortunately, I updated automatically through Homebrew and didn't track which one it was; Positron was working fine. It seems that it just can't handle, in my case, taking an interactive password input like VScode can.

[smped]

Same issue for me as experienced by @yassineS . I've been successfully connecting to a remote using VSCode for years, but it appears Positron will not allow me to enter a password. ssh log below & my naive reading says it may the line: [Info - 08:30:31.764] Trying no-auth authentication

Manual ssh using bash is fine and VSCode is also fine at the same location & WiFi connection.

I'm running Positron on Ubuntu 24.04.2LTS and trying to connect to a server running Rocky Linux 9.4 if that helps.

[Info  - 08:30:31.220] Resolving ssh remote authority 'ssh-remote+foo' (attemp #1)
[Trace  - 08:30:31.239] Identity keys:
/home/stevie/.ssh/id_ed25519 ssh-ed25519 SHA256:uk2unnijAXKsn7xkJ5RUJGcvsYBfcaYYKSbTnokwCGU=
[Trace  - 08:30:31.241] Identity keys:
/home/stevie/.ssh/id_ed25519 ssh-ed25519 SHA256:uk2unnijAXKsn7xkJ5RUJGcvsYBfcaYYKSbTnokwCGU=
[Info  - 08:30:31.764] Trying no-auth authentication
[Info  - 08:30:32.362] Trying publickey authentication: /home/stevie/.ssh/id_ed25519 ssh-ed25519 SHA256:uk2unnijAXKsn7xkJ5RUJGcvsYBfcaYYKSbTnokwCGU=
[Error  - 08:30:32.745] Error resolving authority
Error: All configured authentication methods failed
	at mt (/usr/share/positron/resources/app/extensions/open-remote-ssh/dist/extension.js:1:160854)
	at /usr/share/positron/resources/app/extensions/open-remote-ssh/dist/extension.js:1:407773
	at authHandler (/usr/share/positron/resources/app/extensions/open-remote-ssh/dist/extension.js:1:402290)
	at St (/usr/share/positron/resources/app/extensions/open-remote-ssh/dist/extension.js:1:164072)
	at wt (/usr/share/positron/resources/app/extensions/open-remote-ssh/dist/extension.js:1:164256)
	at USERAUTH_FAILURE (/usr/share/positron/resources/app/extensions/open-remote-ssh/dist/extension.js:1:152821)
	at 51 (/usr/share/positron/resources/app/extensions/open-remote-ssh/dist/extension.js:1:309500)
	at t.exports.M (/usr/share/positron/resources/app/extensions/open-remote-ssh/dist/extension.js:1:183417)
	at k.decrypt (/usr/share/positron/resources/app/extensions/open-remote-ssh/dist/extension.js:1:279111)
	at t.exports.F [as _parse] (/usr/share/positron/resources/app/extensions/open-remote-ssh/dist/extension.js:1:182941)
	at t.exports.parse (/usr/share/positron/resources/app/extensions/open-remote-ssh/dist/extension.js:1:187433)
	at Socket.<anonymous> (/usr/share/positron/resources/app/extensions/open-remote-ssh/dist/extension.js:1:159594)
	at Socket.emit (node:events:518:28)
	at Socket.emit (node:domain:489:12)
	at addChunk (node:internal/streams/readable:561:12)
	at readableAddChunkPushByteMode (node:internal/streams/readable:512:3)
	at Readable.push (node:internal/streams/readable:392:5)
	at TCP.onStreamRead (node:internal/stream_base_commons:191:23)

[sameet]

This issue still persists with me. I get a different error though:

Failed to connect to the remote extension host server (Error: All configured authentication methods failed)

I can connect to the server using Remote SSH. But when I try to connect the positron window there is the following error:

[Info  - 17:48:57.742] Resolving ssh remote authority '[email protected]' (attemp #1)
[Trace  - 17:48:57.751] Identity keys:
/Users/sameet/.ssh/id_rsa ssh-rsa SHA256:tGgC89Y6PAkmxNlNKxsoJVwvKgDTLxJ1n9HckldaFTY=
[Info  - 17:48:58.22] Trying no-auth authentication
[Info  - 17:48:58.124] Trying publickey authentication: /Users/sameet/.ssh/id_rsa ssh-rsa SHA256:tGgC89Y6PAkmxNlNKxsoJVwvKgDTLxJ1n9HckldaFTY=
[Error  - 17:48:58.411] Error resolving authority
Error: All configured authentication methods failed
	at mt (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:160854)
	at /Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:407813
	at authHandler (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:403150)
	at St (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:164072)
	at wt (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:164256)
	at USERAUTH_FAILURE (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:152821)
	at 51 (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:309500)
	at t.exports.M (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:183417)
	at R.decrypt (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:276148)
	at t.exports.F [as _parse] (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:182941)
	at t.exports.parse (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:187433)
	at Socket.<anonymous> (/Applications/Positron.app/Contents/Resources/app/extensions/open-remote-ssh/dist/extension.js:1:159594)
	at Socket.emit (node:events:524:28)
	at Socket.emit (node:domain:489:12)
	at addChunk (node:internal/streams/readable:561:12)
	at readableAddChunkPushByteMode (node:internal/streams/readable:512:3)
	at Readable.push (node:internal/streams/readable:392:5)
	at TCP.onStreamRead (node:internal/stream_base_commons:191:23)

Please advise.

Other Details

I am on a M4 Mac. Same setup as worked previously on a M2 Mac a week ago. I am using the 2025.07.0-204 version of Positron.

[austin3dickey]

Hey @sameet, sorry to hear that this stopped working when you got a new laptop. That's definitely strange and we want to make this experience better for everyone.

I'm not sure why the open-remote-ssh extension sometimes decides to not ask for an interactive password (it still does for me!) but that's what we'll have to investigate to solve this issue.

Does this discussion from the extension's repo help anyone solve the problem? https://github.com/jeanp413/open-remote-ssh/issues/32#issuecomment-1292316934

Alternatively, I've also had success adding my public key to the server so I don't have to enter a password, using something like this from my Mac:

ssh-copy-id -i ~/.ssh/id_ed25519.pub <hostname>

[jemus42]

I'd like to point out the reported error by @sameet here is [Error - 17:48:58.411] Error resolving authority, which is not different from what I mention in the original issue post (it's also in the issue title) and it's also what I report in https://github.com/posit-dev/positron/issues/6221#issuecomment-2656488397 for VSCodium with open-remote-ssh, so I don't think that this is a question of letting the server know about your public key.

The underlying issue still seems that something done by the open-remote-ssh extension used is different from what VSCode is doing with the proprietary Remote SSH extension, and that appears to affect certain hosts only (presumably something related to certificates).

[mvellinger]

Just to add on a "me too", I am having the exact same issue when connecting to a server (my situation is a bit more complex because I am connecting to a bastion tunnel) I can connect VSCode without issue, but Positron fails with the aforementioned errors.

[ateucher]

Also adding a "me too", with a slightly different usage but I think a similar issue. I'm trying to connect to an AWS-hosted JupyterHub. My ssh config uses websocat via ProxyCommand, where I pass a token obtained from the hub via an Authorization header:

The error I get is:

[Info  - 18:36:52.148] Resolving ssh remote authority 'ssh-remote+openscapes.2i2c.cloud' (attemp #1)
[Trace  - 18:36:52.161] Identity keys:
/Users/andy/.ssh/id_ed25519 ssh-ed25519 SHA256:xxxxxx
[Trace  - 18:36:52.161] Spawning ProxyCommand: websocat --binary -H='Authorization: token xxxxx' asyncstdio: wss://openscapes.2i2c.cloud/user/ateucher/sshd/
[Error  - 18:36:52.169] Error resolving authority
Error [ERR_STREAM_PREMATURE_CLOSE]: Premature close
    at Socket.onclose (node:internal/streams/end-of-stream:162:30)
    at Socket.emit (node:events:518:28)
    at Socket.emit (node:domain:489:12)
    at Pipe.<anonymous> (node:net:346:12)

The relevant part of my ~.ssh/config is:

Host openscapes.2i2c.cloud
    HostName openscapes.2i2c.cloud
    User jovyan
    ProxyCommand websocat --binary -H='Authorization: token xxxxx' asyncstdio: wss://%h/user/ateucher/sshd/

I tried it with VSCodium and got the same error, so I think the issue is with open-remote-ssh, but just wanted to add to the story here.

Cursor has an issue where the error is identical to mine.

This does work in VSCode and in the terminal with ssh openscapes.2i2c.cloud

[jmcphers]

Did a deep dive into this today. Open Remote SSH uses a pure Javascript implementation of SSH called ssh2. This implementation is missing a number of features from native SSH and host certificates are among them.

https://github.com/mscdex/ssh2/issues/551 https://github.com/mscdex/ssh2/pull/808 https://github.com/mscdex/ssh2/issues/858

Because the limitation is at the transport layer, we can only resolve it by forking/monkey patching ssh2 (doing the protocol level work needed for support ourselves with some inspiration from the PRs above), or by refactoring Open Remote SSH to use a different SSH implementation (which would almost constitute a rewrite).

[jemus42]

Looks like every VSCode fork (including Cursor and Windsurf) that can't use Microsoft's Remote SSH extension relies on that one random person's (no offense) open source library in a classic case of xkcd 2347 then :/

It seems like it would be worth it to pool some resources into ssh2 or an alternative, but I guess I can only observe that from the sidelines and cross my fingers 😬

[ateucher]

I want to follow up on my comment in case it helps anyone else. I also realize now that my issue is likely different from that originally posted here.

There must be something in the way that ssh2/open-remote-ssh2 parses commands, as I got my config to work simply by using double quotes instead of single quotes in the ProxyCommand:

Host openscapes.2i2c.cloud
  HostName openscapes.2i2c.cloud
  User jovyan
  ProxyCommand websocat --binary -H="Authorization: token XXXX" asyncstdio: wss://%h/user/ateucher/sshd/