I have almost all of my private resources configured with external auth daemon. These resources have worked via ssh in previous releases of panoglin, but I get the following error now:
% pangolin ssh paper.lab
unexpected status code 404: 404 page not found
SSH error: Unauthorized
I have gone through my setup script again and confirmed that the systemd service is running. The SSH config is still accurate as per the KB article. Network has not changed either as I can ping the hosts from the cli host.
Environment
OS Type & Version: MacOS Tahoe 26.5
Pangolin Version: 18.4
Gerbil Version: 1.3.1
Traefik Version: 3.6.14
Newt Version: 12.5
cli Version: 0.8.2
VPN version: 0.8.1
To Reproduce
As far as I can tell, connection to any private resource via certificate authentication are failing to connect to resources running behind a newt connector.
a.mo.@AMos-MacBook-Air ~ % pangolin ssh music.lab
unexpected status code 404: 404 page not found
SSH error: Unauthorized
Expected Behavior
In the past, this has logged in via authenticated user that has access to the resource. Confirmed that the current user has access, so the user p-smash0573 should be logged into the ssh resource. This does not happen.
Originally created by @jelly8perplexed on GitHub (May 16, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/3092
### Describe the Bug
I have almost all of my private resources configured with external auth daemon. These resources have worked via ssh in previous releases of panoglin, but I get the following error now:
% pangolin ssh paper.lab
unexpected status code 404: 404 page not found
SSH error: Unauthorized
I have gone through my setup script again and confirmed that the systemd service is running. The SSH config is still accurate as per the KB article. Network has not changed either as I can ping the hosts from the cli host.
### Environment
- OS Type & Version: MacOS Tahoe 26.5
- Pangolin Version: 18.4
- Gerbil Version: 1.3.1
- Traefik Version: 3.6.14
- Newt Version: 12.5
- cli Version: 0.8.2
- VPN version: 0.8.1
### To Reproduce
As far as I can tell, connection to any private resource via certificate authentication are failing to connect to resources running behind a newt connector.
a.mo.@AMos-MacBook-Air ~ % pangolin ssh music.lab
unexpected status code 404: 404 page not found
SSH error: Unauthorized
### Expected Behavior
In the past, this has logged in via authenticated user that has access to the resource. Confirmed that the current user has access, so the user p-smash0573 should be logged into the ssh resource. This does not happen.
@AstralDestiny commented on GitHub (May 17, 2026):
Throw pangolin into LOG_LEVEL: DEBUG and down and up and also throw traefik into trace logging and gerbil into debugging as per the first part again, Just want to make sure requests are going to the places they need.
where's newt and what did you define as the path and did you set the newt to have the same preshared key for the auth daemon? If using on site you need to use the pangolin client or bare host newt. if using container for on site it won't function.
<!-- gh-comment-id:4468643779 -->
@AstralDestiny commented on GitHub (May 17, 2026):
Throw pangolin into LOG_LEVEL: DEBUG and down and up and also throw traefik into trace logging and gerbil into debugging as per the first part again, Just want to make sure requests are going to the places they need.
where's newt and what did you define as the path and did you set the newt to have the same preshared key for the auth daemon? If using on site you need to use the pangolin client or bare host newt. if using container for on site it won't function.
@jelly8perplexed commented on GitHub (May 18, 2026):
Ok - I will change the debugging hopefully today and re-test. Where can I look in the logs for the results? I also tested with the latest windows version and got the same error.
I am hosting a newt site from my proxmox host in a dedicated VM. It is a bare host; no containers used. As mentioned this had been working in prior versions with no changes to newt or the auth daemons since installation.
<!-- gh-comment-id:4480038337 -->
@jelly8perplexed commented on GitHub (May 18, 2026):
Ok - I will change the debugging hopefully today and re-test. Where can I look in the logs for the results? I also tested with the latest windows version and got the same error.
I am hosting a newt site from my proxmox host in a dedicated VM. It is a bare host; no containers used. As mentioned this had been working in prior versions with no changes to newt or the auth daemons since installation.
@oschwartz10612 commented on GitHub (May 20, 2026):
Yeah this sounds like Traefik is not serving the Pangolin ui or something like that. Does the dashboard work when you visit it? If it does, could you log out of the cli and back in?
<!-- gh-comment-id:4503438343 -->
@oschwartz10612 commented on GitHub (May 20, 2026):
Yeah this sounds like Traefik is not serving the Pangolin ui or something like that. Does the dashboard work when you visit it? If it does, could you log out of the cli and back in?
@jelly8perplexed commented on GitHub (May 21, 2026):
I can get to both the pangolin dashboard and traefik dashboards, I don't see any warnings or errors there. I have yet to change the logging metrics...
<!-- gh-comment-id:4504386021 -->
@jelly8perplexed commented on GitHub (May 21, 2026):
I can get to both the pangolin dashboard and traefik dashboards, I don't see any warnings or errors there. I have yet to change the logging metrics...
The 404 is odd it sounds like the others have pointed out that the route /jit-connect is either not getting to the dashboard but @oschwartz10612 can you confirm where /jit-connect route is registered?
edit: ohhh I see now its an olm api thing via socket.
So im checking and nothing returns a 404 only the default golang http server does. So my only theory is that the vpn client has been running for some time and you upgraded the cli but havent disconnect and reconnected so the tunnel gets the upgraded binary running?
<!-- gh-comment-id:4533875919 -->
@LaurenceJJones commented on GitHub (May 25, 2026):
Hmm the only place where we fall through and log an error only is for the JIT connection request
https://github.com/fosrl/cli/blob/0d924187ec21ba4f73b5a9a10ccc47b70309982b/internal/olm/client.go#L191-L197
The 404 is odd it sounds like the others have pointed out that the route `/jit-connect` is either not getting to the dashboard but @oschwartz10612 can you confirm where `/jit-connect` route is registered?
edit: ohhh I see now its an olm api thing via socket.
So im checking and nothing returns a `404` only the default golang http server does. So my only theory is that the vpn client has been running for some time and you upgraded the cli but havent disconnect and reconnected so the tunnel gets the upgraded binary running?
@jelly8perplexed commented on GitHub (May 26, 2026):
I usually disconnect the client before running upgrades/updates, it's rarely used outside of connection, tasks, and then disconnect.
<!-- gh-comment-id:4548354863 -->
@jelly8perplexed commented on GitHub (May 26, 2026):
I usually disconnect the client before running upgrades/updates, it's rarely used outside of connection, tasks, and then disconnect.
@github-actions[bot] commented on GitHub (Jun 10, 2026):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
<!-- gh-comment-id:4665514607 -->
@github-actions[bot] commented on GitHub (Jun 10, 2026):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@jelly8perplexed commented on GitHub (Jun 12, 2026):
Still not able to connect fully with MacOS. Seems to work fine with PC clients.
<!-- gh-comment-id:4696306501 -->
@jelly8perplexed commented on GitHub (Jun 12, 2026):
Still not able to connect fully with MacOS. Seems to work fine with PC clients.
@oschwartz10612 commented on GitHub (Jun 12, 2026):
@jelly8perplexed are you testing on the latest version of the client and the 1.19.2 server? If not could you?
<!-- gh-comment-id:4696321593 -->
@oschwartz10612 commented on GitHub (Jun 12, 2026):
@jelly8perplexed are you testing on the latest version of the client and the 1.19.2 server? If not could you?
@jelly8perplexed commented on GitHub (Jun 12, 2026):
Thanks for the quick response, I know you guys have a lot on your plate right now.
I am finally getting an error on the client: Unable to coordinate client P2P connection. Please ensure your client can reach the server on UDP port 21820 and try registering again.
I am fully upgraded:
Pangolin running 1.19.2 and MacOS client 0.8.4
<!-- gh-comment-id:4696444701 -->
@jelly8perplexed commented on GitHub (Jun 12, 2026):
Thanks for the quick response, I know you guys have a lot on your plate right now.
I am finally getting an error on the client: Unable to coordinate client P2P connection. Please ensure your client can reach the server on UDP port 21820 and try registering again.
I am fully upgraded:
Pangolin running 1.19.2 and MacOS client 0.8.4
<img width="1572" height="1174" alt="Image" src="https://github.com/user-attachments/assets/9fd60d6e-8961-4e4e-aa6f-805177af2d91" />
<!-- gh-comment-id:4697246743 -->
@oschwartz10612 commented on GitHub (Jun 13, 2026):
Might be related to https://github.com/fosrl/gerbil/issues/96 working on a fix
@jelly8perplexed commented on GitHub (Jun 13, 2026):
@AstralDestiny I have it on my guest network and newt on a public server network, so different networks. I did update gerbil this morning but issue remains. I have yet to test on another completely separate network that the PC worked on.
<!-- gh-comment-id:4699208838 -->
@jelly8perplexed commented on GitHub (Jun 13, 2026):
@AstralDestiny I have it on my guest network and newt on a public server network, so different networks. I did update gerbil this morning but issue remains. I have yet to test on another completely separate network that the PC worked on.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @jelly8perplexed on GitHub (May 16, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/3092
Describe the Bug
I have almost all of my private resources configured with external auth daemon. These resources have worked via ssh in previous releases of panoglin, but I get the following error now:
% pangolin ssh paper.lab
unexpected status code 404: 404 page not found
SSH error: Unauthorized
I have gone through my setup script again and confirmed that the systemd service is running. The SSH config is still accurate as per the KB article. Network has not changed either as I can ping the hosts from the cli host.
Environment
To Reproduce
As far as I can tell, connection to any private resource via certificate authentication are failing to connect to resources running behind a newt connector.
a.mo.@AMos-MacBook-Air ~ % pangolin ssh music.lab
unexpected status code 404: 404 page not found
SSH error: Unauthorized
Expected Behavior
In the past, this has logged in via authenticated user that has access to the resource. Confirmed that the current user has access, so the user p-smash0573 should be logged into the ssh resource. This does not happen.
@AstralDestiny commented on GitHub (May 17, 2026):
Throw pangolin into LOG_LEVEL: DEBUG and down and up and also throw traefik into trace logging and gerbil into debugging as per the first part again, Just want to make sure requests are going to the places they need.
where's newt and what did you define as the path and did you set the newt to have the same preshared key for the auth daemon? If using on site you need to use the pangolin client or bare host newt. if using container for on site it won't function.
@jelly8perplexed commented on GitHub (May 18, 2026):
Ok - I will change the debugging hopefully today and re-test. Where can I look in the logs for the results? I also tested with the latest windows version and got the same error.
I am hosting a newt site from my proxmox host in a dedicated VM. It is a bare host; no containers used. As mentioned this had been working in prior versions with no changes to newt or the auth daemons since installation.
@oschwartz10612 commented on GitHub (May 20, 2026):
Yeah this sounds like Traefik is not serving the Pangolin ui or something like that. Does the dashboard work when you visit it? If it does, could you log out of the cli and back in?
@jelly8perplexed commented on GitHub (May 21, 2026):
I can get to both the pangolin dashboard and traefik dashboards, I don't see any warnings or errors there. I have yet to change the logging metrics...
@LaurenceJJones commented on GitHub (May 25, 2026):
Hmm the only place where we fall through and log an error only is for the JIT connection request
https://github.com/fosrl/cli/blob/0d924187ec21ba4f73b5a9a10ccc47b70309982b/internal/olm/client.go#L191-L197
The 404 is odd it sounds like the others have pointed out that the route
/jit-connectis either not getting to the dashboard but @oschwartz10612 can you confirm where/jit-connectroute is registered?edit: ohhh I see now its an olm api thing via socket.
So im checking and nothing returns a
404only the default golang http server does. So my only theory is that the vpn client has been running for some time and you upgraded the cli but havent disconnect and reconnected so the tunnel gets the upgraded binary running?@jelly8perplexed commented on GitHub (May 26, 2026):
I usually disconnect the client before running upgrades/updates, it's rarely used outside of connection, tasks, and then disconnect.
@github-actions[bot] commented on GitHub (Jun 10, 2026):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@jelly8perplexed commented on GitHub (Jun 12, 2026):
Still not able to connect fully with MacOS. Seems to work fine with PC clients.
@oschwartz10612 commented on GitHub (Jun 12, 2026):
@jelly8perplexed are you testing on the latest version of the client and the 1.19.2 server? If not could you?
@jelly8perplexed commented on GitHub (Jun 12, 2026):
Thanks for the quick response, I know you guys have a lot on your plate right now.
I am finally getting an error on the client: Unable to coordinate client P2P connection. Please ensure your client can reach the server on UDP port 21820 and try registering again.
I am fully upgraded:
Pangolin running 1.19.2 and MacOS client 0.8.4
@AstralDestiny commented on GitHub (Jun 13, 2026):
Same network as newt or different one?
@oschwartz10612 commented on GitHub (Jun 13, 2026):
Might be related to https://github.com/fosrl/gerbil/issues/96 working on a fix
@jelly8perplexed commented on GitHub (Jun 13, 2026):
@AstralDestiny I have it on my guest network and newt on a public server network, so different networks. I did update gerbil this morning but issue remains. I have yet to test on another completely separate network that the PC worked on.