[GH-ISSUE #5101] ssh not work v0.62.2,token has invalid issuer. audience=netbird-cli , audience=netbird-dashboard #9887

Open
opened 2026-08-05 01:23:52 -04:00 by saavagebueno · 3 comments
Owner

Originally created by @openapphub on GitHub (Jan 13, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5101

CLI:

netbird ssh root@100.64.110.12    
SSH authentication required.
Please do the SSO login in your browser.
If your browser didn't open automatically, use this URL to log in:

https://netbird.domain.com/oauth2/auth?audience=netbird-cli&client_id=netbird-cli&code_challenge=9LzY0MbC-Ll9vLDoElOL3HF07EhCfBB_HM63CuOiCRA&code_challenge_method=S256&login_hint=mr.jinxm%40gmail.com&prompt=login&redirect_uri=http%3A%2F%2Flocalhost%3A53000%2F&response_type=code&scope=openid+profile+email+offline_access&state=be1345fdc19052d6df82ceef63c06f58776ed423b58cb7e0

Waiting for authentication...
Authentication successful!
Failed to connect to jinxm@100.64.110.12:22

Troubleshooting steps:
  1. Check peer connectivity: netbird status -d
  2. Verify SSH server is enabled on the peer
  3. Ensure correct hostname/IP is used
Error: dial 100.64.110.12:22: ssh handshake: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain

server log:

2026-01-13T12:56:19Z INFO client/ssh/server/server.go:245: SSH server started on 100.64.110.12:22022
2026-01-13T12:56:19Z INFO client/internal/engine_ssh.go:41: SSH port redirection enabled: 100.64.110.12:22 -> 100.64.110.12:22022
2026-01-13T12:56:19Z INFO client/ssh/config/manager.go:237: Created NetBird SSH client config: /etc/ssh/ssh_config.d/99-netbird.conf
2026-01-13T12:56:19Z INFO client/ssh/config/manager.go:237: Created NetBird SSH client config: /etc/ssh/ssh_config.d/99-netbird.conf
2026-01-13T12:56:27Z INFO client/ssh/server/server.go:776: SSH connection from NetBird peer 100.64.67.41:54543 allowed
2026-01-13T12:56:28Z INFO client/ssh/server/server.go:776: SSH connection from NetBird peer 100.64.67.41:54544 allowed
2026-01-13T12:56:28Z INFO client/ssh/server/server.go:460: JWT validator initialized successfully
2026-01-13T12:56:28Z ERRO shared/auth/jwt/validator.go:191: token could not be parsed: token has invalid claims: token has invalid audience, token has invalid issuer
2026-01-13T12:56:28Z WARN [session: root@100.64.67.41:54544] client/ssh/server/server.go:607: JWT authentication failed: validate token (expected issuer=https://netbird.hk.fastconnect.space, audience=netbird-cli, actual issuer=https://netbird.hk.fastconnect.space/oauth2, audience=netbird-dashboard): token could not be parsed: token has invalid claims: token has invalid audience, token has invalid issuer
2026-01-13T13:01:12Z ERRO client/internal/device_auth.go:76: failed while getting Management Service public key: failed while getting Management Service public key
2026-01-13T13:01:31Z ERRO client/internal/device_auth.go:76: failed while getting Management Service public key: failed while getting Management Service public key

management.json:

{
    "Stuns": [
        {
            "Proto": "udp",
            "URI": "stun:netbird.domain.com:3478"
        }
    ],
    "Relay": {
        "Addresses": [
            "rels://netbird.domain.com:443",
        ],
        "CredentialsTTL": "24h",
        "Secret": "QHsdX87oq...+A8sTs4aNyQFL14"
    },
    "Signal": {
        "Proto": "https",
        "URI": "netbird.domain.com:443"
    },
    "Datadir": "/var/lib/netbird",
    "DataStoreEncryptionKey": "nw/gDiE6lqu+mmpxtsnn3IbkqiJESlvtkaKSuzj+1FI=",
    "HttpConfig": {
        "Address": "0.0.0.0:80",
        "AuthIssuer": "https://netbird.domain.com",
        "AuthAudience": "netbird",
        "IdpSignKeyRefreshEnabled": true
    },
    "ReverseProxy": {
        "TrustedHTTPProxies": ["127.0.0.1/32", "172.17.0.0/16", "10.0.0.0/8", "192.168.0.0/16"],
        "TrustedHTTPProxiesCount": 1,
        "TrustedPeers": ["0.0.0.0/0"]
    },
    "EmbeddedIdP": {
        "Enabled": true,
        "Issuer": "https://netbird.domain.com/oauth2",
        "DashboardRedirectURIs": [
            "https://netbird.domain.com/nb-auth",
            "https://netbird.domain.com/nb-silent-auth",
            "http://localhost:53000/"
        ]
    }
}

The test for disabling JWT authentication can pass. But how to fix this JWT issue?

sudo netbird down
sudo netbird up --allow-server-ssh --disable-ssh-auth
Originally created by @openapphub on GitHub (Jan 13, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5101 CLI: ``` netbird ssh root@100.64.110.12 SSH authentication required. Please do the SSO login in your browser. If your browser didn't open automatically, use this URL to log in: https://netbird.domain.com/oauth2/auth?audience=netbird-cli&client_id=netbird-cli&code_challenge=9LzY0MbC-Ll9vLDoElOL3HF07EhCfBB_HM63CuOiCRA&code_challenge_method=S256&login_hint=mr.jinxm%40gmail.com&prompt=login&redirect_uri=http%3A%2F%2Flocalhost%3A53000%2F&response_type=code&scope=openid+profile+email+offline_access&state=be1345fdc19052d6df82ceef63c06f58776ed423b58cb7e0 Waiting for authentication... Authentication successful! Failed to connect to jinxm@100.64.110.12:22 Troubleshooting steps: 1. Check peer connectivity: netbird status -d 2. Verify SSH server is enabled on the peer 3. Ensure correct hostname/IP is used Error: dial 100.64.110.12:22: ssh handshake: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain ``` server log: ``` 2026-01-13T12:56:19Z INFO client/ssh/server/server.go:245: SSH server started on 100.64.110.12:22022 2026-01-13T12:56:19Z INFO client/internal/engine_ssh.go:41: SSH port redirection enabled: 100.64.110.12:22 -> 100.64.110.12:22022 2026-01-13T12:56:19Z INFO client/ssh/config/manager.go:237: Created NetBird SSH client config: /etc/ssh/ssh_config.d/99-netbird.conf 2026-01-13T12:56:19Z INFO client/ssh/config/manager.go:237: Created NetBird SSH client config: /etc/ssh/ssh_config.d/99-netbird.conf 2026-01-13T12:56:27Z INFO client/ssh/server/server.go:776: SSH connection from NetBird peer 100.64.67.41:54543 allowed 2026-01-13T12:56:28Z INFO client/ssh/server/server.go:776: SSH connection from NetBird peer 100.64.67.41:54544 allowed 2026-01-13T12:56:28Z INFO client/ssh/server/server.go:460: JWT validator initialized successfully 2026-01-13T12:56:28Z ERRO shared/auth/jwt/validator.go:191: token could not be parsed: token has invalid claims: token has invalid audience, token has invalid issuer 2026-01-13T12:56:28Z WARN [session: root@100.64.67.41:54544] client/ssh/server/server.go:607: JWT authentication failed: validate token (expected issuer=https://netbird.hk.fastconnect.space, audience=netbird-cli, actual issuer=https://netbird.hk.fastconnect.space/oauth2, audience=netbird-dashboard): token could not be parsed: token has invalid claims: token has invalid audience, token has invalid issuer 2026-01-13T13:01:12Z ERRO client/internal/device_auth.go:76: failed while getting Management Service public key: failed while getting Management Service public key 2026-01-13T13:01:31Z ERRO client/internal/device_auth.go:76: failed while getting Management Service public key: failed while getting Management Service public key ``` management.json: ``` { "Stuns": [ { "Proto": "udp", "URI": "stun:netbird.domain.com:3478" } ], "Relay": { "Addresses": [ "rels://netbird.domain.com:443", ], "CredentialsTTL": "24h", "Secret": "QHsdX87oq...+A8sTs4aNyQFL14" }, "Signal": { "Proto": "https", "URI": "netbird.domain.com:443" }, "Datadir": "/var/lib/netbird", "DataStoreEncryptionKey": "nw/gDiE6lqu+mmpxtsnn3IbkqiJESlvtkaKSuzj+1FI=", "HttpConfig": { "Address": "0.0.0.0:80", "AuthIssuer": "https://netbird.domain.com", "AuthAudience": "netbird", "IdpSignKeyRefreshEnabled": true }, "ReverseProxy": { "TrustedHTTPProxies": ["127.0.0.1/32", "172.17.0.0/16", "10.0.0.0/8", "192.168.0.0/16"], "TrustedHTTPProxiesCount": 1, "TrustedPeers": ["0.0.0.0/0"] }, "EmbeddedIdP": { "Enabled": true, "Issuer": "https://netbird.domain.com/oauth2", "DashboardRedirectURIs": [ "https://netbird.domain.com/nb-auth", "https://netbird.domain.com/nb-silent-auth", "http://localhost:53000/" ] } } ``` The test for disabling JWT authentication can pass. But how to fix this JWT issue? ``` sudo netbird down sudo netbird up --allow-server-ssh --disable-ssh-auth ```
saavagebueno added the triage-needed label 2026-08-05 01:23:52 -04:00
Author
Owner

@clarkmcc commented on GitHub (Jan 19, 2026):

I'm also having this issue (again) now on 0.63.0 #4604

<!-- gh-comment-id:3769590251 --> @clarkmcc commented on GitHub (Jan 19, 2026): I'm also having this issue (again) now on 0.63.0 #4604
Author
Owner

@Lauszus commented on GitHub (Jan 19, 2026):

I am having the same issue on multiple devices. Netbird ssh works on devices still running 0.61.2.

All devices are running Linux.

<!-- gh-comment-id:3769721920 --> @Lauszus commented on GitHub (Jan 19, 2026): I am having the same issue on multiple devices. Netbird ssh works on devices still running `0.61.2`. All devices are running Linux.
Author
Owner

@clarkmcc commented on GitHub (Jan 19, 2026):

I was finally able to SSH after:

  1. Re-deploying the server from scratch to a new instance
  2. Upgrading my laptop and the target peer to 0.63.0
  3. Configuring the target peer with --allow-server-ssh --enable-ssh-root --disable-ssh-auth

Luckily I can roll out a complete migration to this new server for my entire fleet. Obviously in cases where that's not possible, this is a pretty scary position to be in. Do we know why SSH breaks?

<!-- gh-comment-id:3770093175 --> @clarkmcc commented on GitHub (Jan 19, 2026): I was finally able to SSH after: 1. Re-deploying the server from scratch to a new instance 2. Upgrading my laptop and the target peer to 0.63.0 3. Configuring the target peer with `--allow-server-ssh --enable-ssh-root --disable-ssh-auth` Luckily I can roll out a complete migration to this new server for my entire fleet. Obviously in cases where that's not possible, this is a pretty scary position to be in. Do we know why SSH breaks?
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#9887