paramiko.ssh_exception.AuthenticationException: Authentication failed

TL;DR: The server rejected every auth method paramiko offered. Make paramiko offer what the server accepts: point key_filename at the right private key, supply the passphrase if the key has one, or pass the correct password. Compare against ssh -v to see what the CLI offers.

paramiko.ssh_exception.AuthenticationException: Authentication failed.

Fix it

1. Reproduce with the CLI first: ssh -v with your username at [host]. Expected: note whether it uses a key or password, and which key file.
2. Mirror that in paramiko: for keys, SSHClient().connect(hostname=[host], username=[user], keyfilename='~/.ssh/idrsa'); for passwords, pass your password via the password argument. Expected: auth succeeds.
3. If the key has a passphrase, pass it too: key_filename=..., passphrase=[your passphrase]. Expected: no more failure.
4. Log what was tried: paramiko.util.logtofile('ssh.log') before connecting, then read which methods the server accepted. Expected: the log shows the accepted method.

When this applies

• connect() raises AuthenticationException.
• ssh on the command line works (proves the server and account are fine).

When it doesn't

• The host is unreachable: that is NoValidConnectionsError.
• The key file cannot be parsed: that is the not-a-valid-key error, different fix.

Compatibility

• paramiko 2.x/3.x.

Why it happens

CLI ssh tries your agent, default key files, and prompts; paramiko only tries what you pass it. A script that omits the key file or passphrase offers nothing the server accepts.

Edge cases

• allow_agent=True (default) can offer stale agent keys first and trigger fail2ban; disable it in scripts with many retries.
• Servers with MaxAuthTries low will drop you after a few bad attempts; get the method right before looping.