SSH Handshake complains about missing host key

I'm trying to connect to a remote host and check if a file exist
At this stage I'm trying just to connect but I'm getting an error:

2017/08/01 18:16:39 unable to connect: ssh: handshake failed: ssh: required host key was nil

I've tried to find out if others had issues as mine but I just couldn't find.

I understand that I need to check the knowns_hosts somehow in the process but I just can't figure out how...

	var hostKey ssh.PublicKey
	// A public key may be used to authenticate against the remote
	// server by using an unencrypted PEM-encoded private key file.
	//
	// If you have an encrypted private key, the crypto/x509 package
	// can be used to decrypt it.
	key, err := ioutil.ReadFile("/home/user/.ssh/id_rsa")
	if err != nil {
		log.Fatalf("unable to read private key: %v", err)
	}

	// Create the Signer for this private key.
	signer, err := ssh.ParsePrivateKey(key)
	if err != nil {
		log.Fatalf("unable to parse private key: %v", err)
	}

	config := &ssh.ClientConfig{
		User: "user",
		Auth: []ssh.AuthMethod{
			// Use the PublicKeys method for remote authentication.
			ssh.PublicKeys(signer),
		},
		HostKeyCallback: ssh.FixedHostKey(hostKey),
	}

	// Connect to the remote server and perform the SSH handshake.
	client, err := ssh.Dial("tcp", "host.com:22", config)
	if err != nil {
		log.Fatalf("unable to connect: %v", err)
	}
	defer client.Close()
}

I would suggest to use knownhosts subpackage

import knownhosts "golang.org/x/crypto/ssh/knownhosts"

...

hostKeyCallback, err := knownhosts.New("/Users/user/.ssh/known_hosts")
if err != nil {
	log.Fatal(err)
}

...

config := &ssh.ClientConfig{
    User: "user",
    Auth: []ssh.AuthMethod{
        // Use the PublicKeys method for remote authentication.
        ssh.PublicKeys(signer),
    },
    HostKeyCallback: hostKeyCallback,
}

So that you avoid parsing known_hosts yourself...

hth,

Here what you are looking for:

func getHostKey(host string) (ssh.PublicKey, error) {
file, err := os.Open(filepath.Join(os.Getenv("HOME"), ".ssh", "known_hosts"))
if err != nil {
return nil, err
}
defer file.Close()
scanner := bufio.NewScanner(file)
var hostKey ssh.PublicKey
for scanner.Scan() {
fields := strings.Split(scanner.Text(), " ")
if len(fields) != 3 {
continue
}
if strings.Contains(fields[0], host) {
var err error
hostKey, _, _, _, err = ssh.ParseAuthorizedKey(scanner.Bytes())
if err != nil {
return nil, errors.New(fmt.Sprintf("error parsing %q: %v", fields[2], err))
}
break
}
}
if hostKey == nil {
return nil, errors.New(fmt.Sprintf("no hostkey for %s", host))
}
return hostKey, nil
}

Then replace your hostKey definition line with

hostKey, err := getHostKey("host.com")
if err != nil {
log.Fatal(err)
}

For more information on the subject:

• official sample where I took parts of the code from
• why a hostKey is necessary now

EDIT:
Also check out Anton's answer below about the golang.org/x/crypto/ssh/knownhosts package.

> I would suggest to use knownhosts subpackage

Note that, from Go 1.12 to 1.20 (Q1 2023), you can get:

unable to connect: ssh: handshake failed: ssh: no authorities for hostname

See x/crypto/ssh/knownhosts: can't verify host key if host certificate is sent #33366

> I think this happens due to https://github.com/golang/crypto/blob/dab2b10/ssh/certs.go#L304 not checking cert.Key against c.HostKeyFallback.

Possible patch:

        if !c.IsHostAuthority(cert.SignatureKey, addr) {
+               if c.HostKeyFallback != nil {
+                       err := c.HostKeyFallback(addr, remote, cert.Key)
+                       if err != nil {
+                               return fmt.Errorf("ssh: no authorities for hostname %v. retry with plain key but failed: %v", addr, err)
+                       } else {
+                               return nil
+                       }
+               }
                return fmt.Errorf("ssh: no authorities for hostname: %v", addr)
        }