I've got an SSH tunnel setup on my macbook, like this...
$ ssh -o ServerAliveInterval=3 -N -L 22222:gitosis-server:22 user@firewall.domain.com
So I can ssh to localhost:22222 and will end up on the gitosis-server behind the firewall.
I've created a local id_rsa.pub file, copied it into the gitosis server(running Centos5), and imported it into gitosis using...
# sudo -H -u gitosis gitosis-initIt was successful as I can see the public key in /var/lib/gitosis/.ssh/authorized_keys.
Back on my macbook I setup a ~/.ssh/config file with the following...Host gitosis-server Hostname localhost HostKeyAlias gitosis-server.domain.com Port 22222So...I'm thinking this command should work...
$ git clone gitosis@gitosis-server:gitosis-admin.gitIt does not however as it comes up asking for a password....when the public keys should be working.
Initialized empty Git repository in /Users/USER/Development/gitrepo/gitosis-admin/.git/ gitosis@localhost's password:Any ideas on getting git working through to a gitosis server behind a firewall?
Thanks,
Matt
EDIT - Adding Debug From SSH Attempt
I did this command, 'ssh -vvv gitosis@gitosis-server'. I get some debugging back and it doesn't seem to like my Identity.
debug2: key: /Users/USER/.ssh/id_rsa.gitosis (0x1019b0) debug1: Authentications that can continue: publickey,gssapi-with-mic,password debug3: start over, passed a different list publickey,gssapi-with-mic,password debug3: preferred publickey,keyboard-interactive,password debug3: authmethod_lookup publickey debug3: remaining preferred: keyboard-interactive,password debug3: authmethod_is_enabled publickey debug1: Next authentication method: publickey debug1: Offering public key: /Users/USER/.ssh/id_rsa.gitosis debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply debug1: Authentications that can continue: publickey,gssapi-with-mic,password debug2: we did not send a packet, disable method debug3: authmethod_lookup password debug3: remaining preferred: ,password debug3: authmethod_is_enabled password debug1: Next authentication method: password gitosis@localhost's password:
EDIT 2
OK...Definately a bad key. I double checked all my keys again and of course found the gitosis-server was holding a bad key in the authorized_keys file.
debug1: userauth-request for user gitosis service ssh-connection method none debug1: attempt 0 failures 0 debug1: PAM: initializing for "gitosis" debug1: PAM: setting PAM_RHOST to "firewall.domain.com" debug1: PAM: setting PAM_TTY to "ssh" debug1: userauth-request for user gitosis service ssh-connection method publickey debug1: attempt 1 failures 1 debug1: test whether pkalg/pkblob are acceptable debug1: temporarily_use_uid: 102/103 (e=0/0) debug1: trying public key file /var/lib/gitosis/.ssh/authorized_keys debug1: restore_uid: 0/0 debug1: temporarily_use_uid: 102/103 (e=0/0) debug1: trying public key file /var/lib/gitosis/.ssh/authorized_keys2 debug1: restore_uid: 0/0 Failed publickey for gitosis from FIRE.WALL.IP.ADDRESS port 52453 ssh2
I took a closer look at the authorized_keys file on the gitosis server....and it was incorrect. I double checked the public key file I had copied into /tmp from my workstation and it was the correct one, but different from what was in authorized_keys. I deleted the authorized_keys file on the server and reran the 'sudo -H -u gitosis gitosis-init < /tmp/id_rsa.gitosis.pub'. Checked the authorized_keys file again.....and it was still wrong.
I updated it manually by editing authorized_keys and adding the correct key, and then I got it to work from my workstation through the tunnel for one or two tries. Then it stopped working as before. I went back in to the authorized_keys file on the gitosis server, and sure enough....gitosis had reverted it back to the old key that does not work.
Why is it doing this....reverting back to a bad public key....even after I tried adding it with the above command...which failed to change it....then changed it manually....which worked but git then reverted back to the bad one again.
It's like gitosis keeps remembering the first key I put in there....and won't let me change it to the corrected key.
Frustrating...
Matt
I had a similiar problem and I solved it with:
Maybe your keys were cached there?
Followup:
I'm not sure why gitosis insisted on reusing a bad public key. Trying to force it to take the correct key did not work.
So today I just removed and reinstalled the gitosis package on my CentOS5 box.
On my Mac, I SSH tunnel localhost:22222 through the firewall to gitosis-server:22.
On my Mac, I created ~/.ssh/config that looks like this...
Then...following the instructions on this site...
http://scie.nti.st/2007/11/14/hosting-git-repositories-the-easy-and-secure-way
...everything after... "Here some cool magic happens. Run this on your local machine:"... just works... except remember to replace the username "git" with "gitosis".
Hope all that nonsense helps somebody. Thanks also for the suggestions I got here....it helped narrow down the problem.
Matt
My setup for similar situation (working)
I have similar setup for repo.or.cz (which is for some reason null-route blocked by ISP I use, Polish ISP Telekomunikacja S.A. (tpnet)), and it works for me:
I run the following command run to set up SSH tunel before attempting to connect:
(I use
autossh
instead ofssh
to reconnect if I am disconnected, i.e. to keep connection up). Check that appropriate identities are added to SSH authentication agent:I use keychain to have to provide passwords for my private SSH keys only once, at login.
I have the following set up in my
~/.ssh/config
:This setup works for me without problems.
Debugging your situation
As for debugging your situation?
First, I would check if I can log in to gateway using "ssh user@firewall.domain.com", to check if SSH tunnel can be set up. If you are on Linux you can use for example
netstat --tcp
to check if there is connection established to gateway; on other operating systems and environments you can find similar utilities.Check if you can connect correctly to gitosis. (If I remember correctly gitorious is using gitosis for managing access via SSH, so I used response from gitorious in example below)
If it doesn't do something similar to above (repo.or.cz returns "fatal: What do you think I am? A shell?", GitHub returns "Hi user! You've successfully authenticated, but GitHub does not provide shell access."), check where it fails with "ssh -v gitosis@gitosis-server":
This is an
ssh
issue and not (yet) agit
issue.ssh -v
is your friend as it will give you debug information about what authentication methods and keysssh
is attempting to use.Nine times out of ten I find that this is an issue with permissions on key files.
ssh
likes your.ssh
directory and yourid_rsa
file to be only writeable by 'user' and my umask allows group writeable files by default.ssh -v
will tell you if this is the case in your situation.Edit
It does look like the sshd server doesn't accept your identity. I don't know if you have access to the remote server, but running an
sshd
server in debug mode might help.Running something like this allows one connection on the given port (so that it doesn't interrupt the normal
sshd
service) and outputs debug information. This may help debug why the server doesn't like your identity.If your 'normal' sshd service runs with extra parameters make sure to supply these to the debug version as well.
You say you can ssh to
localhost:2222
successfully. To check that you have set up~/.ssh/config
correctly, can you ssh to justgitosis-server
?