PuTTY authentication failure after server-side credential expiry: can the client distinguish it from a rejected key?
0 reputation · 20 Jul 2026, 09:51 UTC
0 reputation · 20 Jul 2026, 09:51 UTC
I am hardening an SSH access workflow that relies on PuTTY with public-key authentication (keys loaded through Pageant) as a least-privilege alternative to passwords. Accounts and keys on the server side are subject to expiration and revocation policies.
The problem I keep hitting is diagnostic: when a session fails during the SSH handshake, PuTTY aborts and reports an authentication failure, but the message does not seem to tell me whether the credential was merely rejected or whether it failed because the account or key expired on the server. My understanding is that PuTTY does not manage password aging or account expiry itself and only surfaces whatever the server returns, so the distinction may not be visible client-side at all.
Assume a current PuTTY release (0.7x/0.8x) against OpenSSH servers; exact error text may vary, so I am not quoting a specific string.
Specifically:
A thoughtful contribution can make all the difference. Be the first to share one.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.