go-cli-ssh-identitiesonly

Answer

Root cause. Every client-side ssh command builder (used by bunker cp, deploy, mount, and tunnel) assembled args like:

[]string{"ssh", "-i", keyPath, ...}

-i <key> tells OpenSSH to add a key, but it does not restrict the identities offered. With an ssh-agent loaded (typical on a remote client workstation), ssh first offers every agent key, one auth attempt each. Once the server's MaxAuthTries budget (default 6) is exhausted, OpenSSH aborts with "Too many authentication failures" and the connection drops — scp surfaces this as "Connection closed". bunker exec was immune because it executes server-side and never builds a client ssh command line.

The fix. Add -o IdentitiesOnly=yes to every client ssh/scp/sshfs/tunnel arg builder. This makes ssh offer only the identities explicitly listed via -i/IdentityFile, ignoring all other agent keys. Command-line -o overrides ssh_config, so this also shields against a user's config file enabling agent-based identity offering.

1. sshhost.go — clientTunnelArgs (inject-if-absent). Centralize the guard so it is applied consistently and never duplicated:

// ensureIdentitiesOnly guarantees -o IdentitiesOnly=yes is present.
// Injected (not blindly appended) so a caller that already set the
// option does not get a conflicting duplicate.
func ensureIdentitiesOnly(args []string) []string {
    for i := 0; i < len(args)-1; i++ {
        if args[i] == "-o" && args[i+1] == "IdentitiesOnly=yes" {
            return args
        }
    }
    // Append at the end: later -o directives override earlier ones,
    // and command-line options always override ssh_config.
    return append(args, "-o", "IdentitiesOnly=yes")
}

// clientTunnelArgs builds the client-side ssh command for bunker tunnel.
func clientTunnelArgs(host string, port int, key, local, remote string) []string {
    args := []string{
        "ssh",
        "-i", key,               // explicit key …
        "-o", "IdentitiesOnly=yes", // … and ONLY that key (fix)
        "-p", strconv.Itoa(port),
        "-N",
        "-L", local + ":" + remote,
        host,
    }
    return ensureIdentitiesOnly(args)
}

2. cp.go — scp builder for bunker cp:

func (c *client) cpArgs(remote, local, key string) []string {
    return []string{
        "scp",
        "-o", "IdentitiesOnly=yes", // fix: don't offer agent keys first
        "-i", key,
        "-P", strconv.Itoa(c.port),
        remote, local,
    }
}

3. deploy.go — deploy's scp/ssh push:

args := []string{
    "scp",
    "-o", "IdentitiesOnly=yes", // fix
    "-i", keyPath,
    "-P", strconv.Itoa(port),
    bundle,
    user + "@" + host + ":" + remotePath,
}

4. mount.go — sshfs builder (sshfs passes options through to the underlying ssh; note it uses -o IdentityFile= rather than -i):

args := []string{
    "sshfs",
    "-o", "IdentitiesOnly=yes", // fix
    "-o", "IdentityFile=" + keyPath,
    "-o", "Port=" + strconv.Itoa(port),
    user + "@" + host + ":" + remoteDir,
    mountPoint,
}

5. manager_spawn.go — bundled spawn args (when the CLI spawns the manager process that itself runs ssh client commands):

bundle := []string{
    "ssh",
    "-i", keyPath,
    "-o", "IdentitiesOnly=yes", // fix
    "-o", "StrictHostKeyChecking=accept-new",
    "-p", strconv.Itoa(port),
    host,
}
// or: bundle = ensureIdentitiesOnly(bundle)

For maximum DRY, all five builders can simply route through ensureIdentitiesOnly(...); the explicit -o IdentitiesOnly=yes placement directly before -i in the literal slices is equivalent and self-documenting.