# Git SSH Authentication

4 messages from 2012-02-11 to 2012-02-11. Participants: isawk, Sitaram Chamarty, Junio C Hamano.
Thread: https://gitlist.dev/t/29600

## isawk, 2012-02-11 04:01

Subject: Git SSH Authentication
Message-ID: <loom.20120211T045801-602@post.gmane.org>
URL: https://gitlist.dev/e/loom.20120211T045801-602%40post.gmane.org

```
I'm unable to authenticate with git through ssh public key/password-less
authentication.

# git push origin master
# Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
# fatal: The remote end hung up unexpectedly

git version

git version 1.7.8.4

git user

has .ssh/authorized_keys containing public key, but still nothing. I'm confused
on how to go about fixing this issue.

```

## Sitaram Chamarty, 2012-02-11 05:05

Subject: Re: Git SSH Authentication
Message-ID: <CAMK1S_jmY5KvBH8z6YKszroMai4O5ULeCBYGAGFT4CgVUAfmwg@mail.gmail.com>
URL: https://gitlist.dev/e/CAMK1S_jmY5KvBH8z6YKszroMai4O5ULeCBYGAGFT4CgVUAfmwg%40mail.gmail.com
In-Reply-To: <loom.20120211T045801-602@post.gmane.org>

```
On Sat, Feb 11, 2012 at 9:31 AM, isawk <kwasi.gyasiagyei@4things.co.za> wrote:
> I'm unable to authenticate with git through ssh public key/password-less
> authentication.
>
> # git push origin master
> # Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
> # fatal: The remote end hung up unexpectedly

if it didn't ask you for a password when pubkey access failed, that's
non-default.  Someone explicitly told sshd to do that.

Common causes of pubkey access fail:

  - wrong pubkey being used: run your ssh with '-vv' and look for
"offered".  make sure the pubkey that is being offered has been added
to the server side ~/.ssh/authorized_keys
  - wrong pubkey being offered: if you are using ssh-agent, make sure
you have 'ssh-add'ed the key you want to offer.  Confirm with 'ssh-add
-l'
  - wrong permissions on server side: sshd is very picky about
permissions.  Any directory component of $HOME/.ssh having g+w or o+w
will make it refuse.  Or wrong ownership (for example if you created a
file using root).
  - AllowUsers setting on server side /etc/ssh/ssd_config: this item
is not set by default, which allows everyone to log in.  But if
someone set it in for some reason, then the git user must also be
added to it.

In general, looking in server side /var/log/auth.log or
/var/log/secure or some such file will give you more information.

```

## Junio C Hamano, 2012-02-11 07:54

Subject: Re: Git SSH Authentication
Message-ID: <7vty2xn6tl.fsf@alter.siamese.dyndns.org>
URL: https://gitlist.dev/e/7vty2xn6tl.fsf%40alter.siamese.dyndns.org
In-Reply-To: <CAMK1S_jmY5KvBH8z6YKszroMai4O5ULeCBYGAGFT4CgVUAfmwg@mail.gmail.com>

```
Sitaram Chamarty <sitaramc@gmail.com> writes:

> Common causes of pubkey access fail:
>
>   - wrong pubkey being offered: if you are using ssh-agent, make sure
> you have 'ssh-add'ed the key you want to offer.  Confirm with 'ssh-add
> -l'

A failure related to this I saw is to have (too) many keys in ssh-agent,
and running ssh without telling it which exact key to use.  The client
tries each key in turn and the server rejects the connection attempt after
seeing too many keys tried.  "ssh -v" is useful to diagnose this mode of
failure, and an entry in ~/.ssh/config like:

    Host example.com
	User myusernameoverthere
        IdentityFile ~/.ssh/id_rsa-for-example.com

would fix it.

```

## Sitaram Chamarty, 2012-02-11 10:23

Subject: Re: Git SSH Authentication
Message-ID: <CAMK1S_hxUDx8M+JpiDguUETkUhfQzmpHj-s6++BXrknGRMR7vg@mail.gmail.com>
URL: https://gitlist.dev/e/CAMK1S_hxUDx8M%2BJpiDguUETkUhfQzmpHj-s6%2B%2BBXrknGRMR7vg%40mail.gmail.com
In-Reply-To: <7vty2xn6tl.fsf@alter.siamese.dyndns.org>

```
On Sat, Feb 11, 2012 at 1:24 PM, Junio C Hamano <gitster@pobox.com> wrote:
> Sitaram Chamarty <sitaramc@gmail.com> writes:
>
>> Common causes of pubkey access fail:
>>
>>   - wrong pubkey being offered: if you are using ssh-agent, make sure
>> you have 'ssh-add'ed the key you want to offer.  Confirm with 'ssh-add
>> -l'
>
> A failure related to this I saw is to have (too) many keys in ssh-agent,
> and running ssh without telling it which exact key to use.  The client
> tries each key in turn and the server rejects the connection attempt after
> seeing too many keys tried.  "ssh -v" is useful to diagnose this mode of
> failure, and an entry in ~/.ssh/config like:
>
>    Host example.com
>        User myusernameoverthere
>        IdentityFile ~/.ssh/id_rsa-for-example.com
>
> would fix it.

Interesting... I didn't know this, so I checked man sshd_config
looking for exactly how many keys it would fail after.  The setting
seems to be MaxAuthTries, and defaults to 6.

-- 
Sitaram

```