mainSavannah Administration - Support: sr #110545, SSH key not recognized on Git...

 
 

sr #110545: SSH key not recognized on Git commit

Submitter:  Mohammad Akhlaghi <makhlaghi>
Submitted:  Thu 30 Sep 2021 09:57:15 PM UTC
   
 
Category:  Source code repositories - developer access Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  rwp
Operating System:  GNU/Linux Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Fri 31 Dec 2021 03:58:11 AM UTC, comment #17: 

I think this is now resolved.  Assigning to me and closing.  But I do appreciate status reports either good or bad about it.

Bob Proulx <rwp>
Site Administrator
Fri 31 Dec 2021 03:54:36 AM UTC, comment #16: 

It was actually on the 24th that I switched the git services from the old server over to the new server.  And there were some problems with incomplete setup found.  I think we are past those problems.  Past them unless and until someone reports something again unexpected.

The new server is a fully updated Trisquel 9 system.  Which is to say that it should be well past the SHA1 obsolescence problem that was originally reported.

For those people who have applied the HostkeyAlgorithms +ssh-rsa workarounds it would be a good idea to remove that and verify that everything is still happy without it.  If you do please make a report that it is okay for you.  Or otherwise if it is not.

Bob Proulx <rwp>
Site Administrator
Mon 11 Oct 2021 11:04:58 AM UTC, comment #15: 

Thank you, Bob!

Much appreciated.

Bests
Luis

Luis Falcon <meanmicio>
Sun 10 Oct 2021 08:35:31 PM UTC, comment #14: 

I have updated the wiki page with updated information concerning this issue.

https://savannah.gnu.org/maintenance/SshAccess/

Bob Proulx <rwp>
Site Administrator
Fri 08 Oct 2021 02:19:36 AM UTC, comment #13: 


comment #12:

> Just in case this help other, this issue manifests for me as a "Host key verification failed"


Noting that I'm on OpenSSH 8.8p1 from Guix System as of yesterday.

Ben Sturmfels <sturm>
Fri 08 Oct 2021 01:32:41 AM UTC, comment #12: 

comment #10:

> The problem is triggered by the deprecation of SHA1 hashes in the new OpenSSH 8.8 release from last week.  Which prevents the host key from being accepted.  I am not sure why switching to an ed25519 key avoids this.  But if that works then great as ed25519 keys are both stronger and more compact.  They will likely become the default in a future release.


Just in case this help other, this issue manifests for me as a "Host key verification failed":


$ git pull
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ED25519 key sent by the remote host is
SHA256:o/oI4CKKcWc4cZvDFEdmOXsE3tiPP8bWa04h4bQjtV4.
Please contact your system administrator.
Add correct host key in /home/ben/.ssh/known_hosts to get rid of this message.
Offending RSA key in /home/ben/.ssh/known_hosts:199
Host key for git.sv.gnu.org has changed and you have requested strict checking.
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.


The `HostkeyAlgorithms` and `PubkeyAcceptedAlgorithms` overrides below work for me.

Regards,
Ben

Ben Sturmfels <sturm>
Tue 05 Oct 2021 03:36:29 PM UTC, comment #11: 

Thanks for the update! I also figured that if ED25519 worked, then that was a net win and I should just go with it. Hope the entanglements aren't too hard to clear up.

Eric Abrahamsen <girzel>
Tue 05 Oct 2021 07:10:30 AM UTC, comment #10: 

The problem is triggered by the deprecation of SHA1 hashes in the new OpenSSH 8.8 release from last week.  Which prevents the host key from being accepted.  I am not sure why switching to an ed25519 key avoids this.  But if that works then great as ed25519 keys are both stronger and more compact.  They will likely become the default in a future release.

For a temporary workaround on the client side please apply the "old-host" mitigation described in the OpenSSH 8.8 release notes.  This allows the ssh-rsa algorithm on the client side again and is reported to solve the problem.  (I can't test this because my unstable system only has OpenSSH 8.4 available and everything works there.)

https://www.openssh.com/releasenotes.html

Host old-host
    HostkeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa

And to be clear "old-host" here is a placeholder for the name of the host as it is being used to connect.  Here for example if git.savannah.gnu.org is the name being used to connect then the above must match it exactly.  If you are using a different alias then match it using whatever alias you are using.

Host git.savannah.gnu.org
    HostkeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa

That will allow the connection to proceed.  I consider this only a temporary workaround to the problem.  Obviously upgrading the server side of the connection is best.  However digging into it tonight again revealed various entanglements that will need to be worked through and prevent it from being an easy trivial thing to do.  Ugh.

Bob Proulx <rwp>
Site Administrator
Mon 04 Oct 2021 11:48:25 PM UTC, comment #9: 


comment #8:

> But generally, I hope you can update the OpenSSH of the Git/Mercurial server(s) to avoid other old-version related issues that will inevitably pop up sometime in the future (at least to a version similar to the CVS OpenSSH version).


I certainly hope someone can! But I'm just a regular user, I don't have any control over the servers.

Eric Abrahamsen <girzel>
Mon 04 Oct 2021 10:56:35 PM UTC, comment #8: 

Thank you very much Eric! I can confirm that after making an ED25519 key and putting it on Savannah, I was able to push my Git commits to Savannah :-).

But generally, I hope you can update the OpenSSH of the Git/Mercurial server(s) to avoid other old-version related issues that will inevitably pop up sometime in the future (at least to a version similar to the CVS OpenSSH version).

Mohammad Akhlaghi <makhlaghi>
Mon 04 Oct 2021 09:49:31 PM UTC, comment #7: 

I had the same issue. I solved it by creating a new ssh key using the ED25519 format and adding it to my account, everything worked fine after that.

Eric Abrahamsen <girzel>
Mon 04 Oct 2021 07:40:21 PM UTC, comment #6: 

I am just posting a comment that I am looking at the situation starting now.

Bob Proulx <rwp>
Site Administrator
Mon 04 Oct 2021 03:14:08 PM UTC, comment #5: 

So what is the nproposed solution to be able to push commits from mercurial / Git? We are blocked.


Luis Falcon <meanmicio>
Mon 04 Oct 2021 02:57:49 PM UTC, comment #4: 


> Can we upgrade the SSH server at Savannah?


Some day we shall, probably with the OS, but I have no ETA.

Ineiev <ineiev>
Site Administrator
Mon 04 Oct 2021 12:35:50 PM UTC, comment #3: 

I'm hitting the same issue on Mercurial (send_pubkey_test: no mutual signature algorithm). Talking in IRC, seems like the problem might that the client and server versions are way apart (thanks kilobug)

Savannah is running SSH server OpenSSH_6.6.1p1 and my client on Arch is running OpenSSH_8.8p1

Can we upgrade the SSH server at Savannah?

Thank you

Luis Falcon <meanmicio>
Fri 01 Oct 2021 12:19:33 PM UTC, comment #2: 

Thank you very much for the prompt reply.

While I was following the debugging steps on the SshAccess page, I noticed that my key gets recognized by the CVS server, but not the SSH server. In other words, the first command below prints the expected output in the SshAccess page, but the second command, doesn't recognize my public key and asks for my git.savannah.gnu.org password (the only difference between the two commands is the 'cvs' and 'git' before '.savannah'):


$ ssh makhlaghi@cvs.savannah.gnu.org
You tried to execute:
Sorry, you are not allowed to execute that command.
Connection to cvs.savannah.gnu.org closed.


$ ssh makhlaghi@git.savannah.gnu.org
makhlaghi@git.savannah.gnu.org's password:


So I tried running both commands with the '-v' option and noticed that they are actually connecting two different operating systems with different versions of OpenSSH, and different algorithms (and possibly other different settings), see below for relevant parts I could see a difference:


$ ssh -v makhlaghi@cvs.savannah.gnu.org
...
debug1: compat_banner: match: OpenSSH_7.4p1 Debian-10+deb9u7 pat OpenSSH_7.4* compat 0x04000006
...
debug1: kex: algorithm: curve25519-sha256
...
debug1: Offering public key: /path/to/my/key/id_rsa RSA SHA256:XXXXXXXXXXXXXXXXXXXXXX agent
debug1: Server accepts key: /path/to/my/key/id_rsa RSA SHA256:XXXXXXXXXXXXXXXXXXXXXX agent
...



$ ssh -v makhlaghi@git.savannah.gnu.org
...
debug1: compat_banner: match: OpenSSH_6.6.1p1 Trisquel_GNU/linux_7.0-1 pat OpenSSH_6.6.1* compat 0x04000002
...
debug1: kex: algorithm: curve25519-sha256@libssh.org
...
debug1: Offering public key: /path/to/my/key/id_rsa RSA SHA256:XXXXXXXXXXXXXXXXXXXXXX agent
debug1: send_pubkey_test: no mutual signature algorithm
...


So I think the problem lies in the Savannah Git server (because my network and OS settings work perfectly fine with the CVS server). But please let me know if any other output from the SSH command can be helpful in debugging this?

Mohammad Akhlaghi <makhlaghi>
Fri 01 Oct 2021 05:10:55 AM UTC, comment #1: 

original submission:

> $ git push origin master
> XXXXXXXXX@git.savannah.gnu.org's password:


These "X...X" are "makhlaghi", aren't they?

> Has anything changed on the Savannah Git server in the last few days?


TTBOMK, no.

> If not, can you help me in debugging this?


Please check https://savannah.gnu.org/maintenance/SshAccess/.

Ineiev <ineiev>
Site Administrator
Thu 30 Sep 2021 09:57:15 PM UTC, original submission:  

Since yesterday, I am unable to git push to Gnuastro's Git repo:


$ git push origin master
XXXXXXXXX@git.savannah.gnu.org's password:


And this is the URL of the 'origin' remote:


$ git remote -v
origin        XXXXXXXXX@git.savannah.gnu.org:/srv/git/gnuastro.git (fetch)
origin        XXXXXXXXX@git.savannah.gnu.org:/srv/git/gnuastro.git (push)


I have checked the SSH key with another server and it works nicely, so I don't understand what is causing this? I also created a new SSH key and put the public key on Savannah, but it still gives the same error (not recognizing my key and asking for a password!)!

Has anything changed on the Savannah Git server in the last few days? If not, can you help me in debugging this?

Mohammad Akhlaghi <makhlaghi>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by sturm (Posted a comment)
  • -email is unavailable- added by girzel (Posted a comment)
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by meanmicio (Posted a comment)
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by makhlaghi (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-12-31 rwp Assigned toNone rwp
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code