ax ssh fails when too many ssh keys already exist

[er4z0r]

Background:

• using the latest ax version (ax update says it is fine)
• using Digital Ocean
• I have several ssh private keys for different purposes

Problem

When I try to connect to my fleet instances I receive an error message:

ax ssh <targetinstance>
Received disconnect from xxx.xxx.xxx.xx port 2266:2: Too many authentication failures
Disconnected from xxx.xxx.xxx.xx port 2266

This is usually a clear indication that ssh is trying all my private keys before it reaches the one configured in ~/.axiom/axiom.json. I was able to confirm this by removing all my keys from the ssh-agent, which results in axiom connecting normally.

Workaround

I managed to fix the problem by:

1. ax ssh --just-generate (to generate ~/.axiom/.sshconfig)
2. ax ssh --just-generate cache (to prevent ax from overwriting my modified config)
3. Modify ~/.axiom/.sshconfig by adding: IdentitiesOnly yes right below the line that says IdentityFile
4. Retry ax ssh <targetinstance> this time with success

Suggested fix

Since ax is using a specific pubkey anyway, it might make sense to add that IdentitiesOnly yes to .sshconfig by default.

[0xtavian]

Hey @er4z0r!

I apologize for the delay, and thank you so much for reporting! I plan on testing and patching this over the weekend. Thanks again!

[0xtavian]

Hey @er4z0r, sorry for not getting to this yet. The simplest fix would be to add IdentitiesOnly yes to the 10 provider functions, specifically the generate_sshconfig function.

But (FWIW) I’ve been meaning to extract some logic away from these 10 functions and instead make them into a shared function. Which would basically reduce each generate_sshconfig provider function, so it only needs to get some data like name, public_ip, private_ip here, and call the new shared function.

So long and short is, I need a little more time. If you need help creating a temporary solution (if yours is a little cumbersome) feel free to DM me on discord. I apologize for the delay again. Working on this now actually, but might be another week until I merge to master. Thanks again for reporting it! <3

[er4z0r]

Thank you. I had actually already done as you suggested and fixed the providers. Just haven't gotten around to commiting it to my fork and doing a PR. FWIW I had the exact same thought (extract that functionality instead of duplicating it) but I had a lot going on so I did it the lazy/quick way and just added that line to each provider 😁. Octavian ***@***.***> schrieb am Sa., 14. Feb. 2026, 20:40:

…

*0xtavian* left a comment (attacksurge/ax#58) <#58 (comment)> Hey @er4z0r <https://github.com/er4z0r>, sorry for not getting to this yet. The simplest fix would be to add IdentitiesOnly yes to the 10 provider functions <https://github.com/attacksurge/ax/tree/master/providers>, specifically the generate_sshconfig <https://github.com/attacksurge/ax/blob/master/providers/aws-functions.sh#L190> function. But (FWIW) I’ve been meaning to extract some logic away from these 10 functions and instead make them into a shared function <https://github.com/attacksurge/ax/blob/master/interact/includes/vars.sh#L48>. Which would basically reduce each generate_sshconfig provider function, so it only needs to get some data like name, public_ip, private_ip here <https://github.com/attacksurge/ax/blob/master/providers/aws-functions.sh#L235>, and call the new shared function. So long and short is, I need a little more time. If you need help creating a temporary solution (if yours is a little cumbersome) feel free to DM me on discord. I apologize for the delay again. Working on this now actually, but might be another week until I merge to master. Thanks again for reporting it! <3 — Reply to this email directly, view it on GitHub <#58 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACF5XB2DCLNDQCA5PP56K34L524TAVCNFSM6AAAAACT6DGLM2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTSMBSGQYDEOBUG4> . You are receiving this because you were mentioned.Message ID: ***@***.***>