threads / discuss / 29600

Git SSH Authentication

Subject: Git SSH Authentication

## tl;dr

4 messages between Feb 11, 2012 and Feb 11, 2012.

replies: 3people: 3as markdown or json

isawk· Feb 11, 2012, 04:01 UTC · lore

I'm unable to authenticate with git through ssh public key/password-less authentication.

# git push origin master # Permission denied (publickey,gssapi-keyex,gssapi-with-mic). # fatal: The remote end hung up unexpectedly

git version

git version 1.7.8.4

git user

has .ssh/authorized_keys containing public key, but still nothing. I'm confused on how to go about fixing this issue.

Sitaram Chamarty· Feb 11, 2012, 05:05 UTC · re: isawk · lore

Re: Git SSH Authentication

On Sat, Feb 11, 2012 at 9:31 AM, isawk <kwasi.gyasiagyei@4things.co.za> wrote:

Show 6 quoted lines

> I'm unable to authenticate with git through ssh public key/password-less
> authentication.
>
> # git push origin master
> # Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
> # fatal: The remote end hung up unexpectedly

if it didn't ask you for a password when pubkey access failed, that's non-default. Someone explicitly told sshd to do that.

Common causes of pubkey access fail:

  - wrong pubkey being used: run your ssh with '-vv' and look for
"offered".  make sure the pubkey that is being offered has been added
to the server side ~/.ssh/authorized_keys
  - wrong pubkey being offered: if you are using ssh-agent, make sure
you have 'ssh-add'ed the key you want to offer.  Confirm with 'ssh-add
-l'
  - wrong permissions on server side: sshd is very picky about
permissions.  Any directory component of $HOME/.ssh having g+w or o+w
will make it refuse.  Or wrong ownership (for example if you created a
file using root).
  - AllowUsers setting on server side /etc/ssh/ssd_config: this item
is not set by default, which allows everyone to log in.  But if
someone set it in for some reason, then the git user must also be
added to it.

In general, looking in server side /var/log/auth.log or /var/log/secure or some such file will give you more information.

Junio C Hamano· Feb 11, 2012, 07:54 UTC · re: Sitaram Chamarty · lore

Re: Git SSH Authentication

Sitaram Chamarty <sitaramc@gmail.com> writes:

Show 5 quoted lines

> Common causes of pubkey access fail:
>
>   - wrong pubkey being offered: if you are using ssh-agent, make sure
> you have 'ssh-add'ed the key you want to offer.  Confirm with 'ssh-add
> -l'

A failure related to this I saw is to have (too) many keys in ssh-agent, and running ssh without telling it which exact key to use. The client tries each key in turn and the server rejects the connection attempt after seeing too many keys tried. "ssh -v" is useful to diagnose this mode of failure, and an entry in ~/.ssh/config like:

    Host example.com
	User myusernameoverthere
        IdentityFile ~/.ssh/id_rsa-for-example.com

would fix it.

Sitaram Chamarty· Feb 11, 2012, 10:23 UTC · re: Junio C Hamano · lore

Re: Git SSH Authentication

On Sat, Feb 11, 2012 at 1:24 PM, Junio C Hamano <gitster@pobox.com> wrote:

Show 19 quoted lines

> Sitaram Chamarty <sitaramc@gmail.com> writes:
>
>> Common causes of pubkey access fail:
>>
>>   - wrong pubkey being offered: if you are using ssh-agent, make sure
>> you have 'ssh-add'ed the key you want to offer.  Confirm with 'ssh-add
>> -l'
>
> A failure related to this I saw is to have (too) many keys in ssh-agent,
> and running ssh without telling it which exact key to use.  The client
> tries each key in turn and the server rejects the connection attempt after
> seeing too many keys tried.  "ssh -v" is useful to diagnose this mode of
> failure, and an entry in ~/.ssh/config like:
>
>    Host example.com
>        User myusernameoverthere
>        IdentityFile ~/.ssh/id_rsa-for-example.com
>
> would fix it.

Interesting... I didn't know this, so I checked man sshd_config looking for exactly how many keys it would fail after. The setting seems to be MaxAuthTries, and defaults to 6.

-- 
Sitaram