10

I have server script that automatically pulls down and installs a github repository. As part of the script, I'm running ssh-keyscan -H github.com >> ~/.ssh/known_hosts as the git user to automatically accept github's RSA key prior to checking out the repo.

I have successfully used this same script in a local vagrant instance, as well as on several servers. However, on one of the servers this doesn't work, because ssh-keyscan -H github.com doesn't return any output (I've tried this as the git user, my personal user, and as root, and the command acts the same). I can ping github.com, so it's not a connection issue; I can also run ssh-keyscan successfully on another server in the same network. I've tried upgrading SSH to see if that might be the issue, but it is already on the latest version for my distribution (CentOS 7).

Where would be a good place to start in troubleshooting this? I've tried searching StackExchange for issues related to 'ssh-keyscan', but I haven't yet found anything that fits this particular problem.

3
  • Update: I have also removed and reinstalled (and restarted) SSH. The problem remains. Perhaps this implies a config issue, but I don't see anything unusual in the config files. – Jay Feb 20 '17 at 19:11
  • 1
    I know this is a bit off topic but in situations where you control the remote server you might want to check whether SSH is listening on IPv6 connections on that server. ssh-keyscan prefers IPv6 over IPv4 by default if it's available. And it could be the reason it can't connect. – Ogier Schelvis Nov 30 '18 at 8:03
  • To clarify: ssh-keyscan localhost gave this error: "write(localhost): Connection refused", but ssh-keyscan -4 localhost worked. – Yeti Jun 22 '20 at 7:37
5

This does sound like a network problem to me.

The first thing that I would do is try telnetting to various SSH servers on port 22, something like the following:

$ telnet local-git-server 22

followed by:

$ telnet github.com 22

When you run this, you should see similar output to the following:

Escape character is '^]'. SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2

This is a good indication that ssh is permitted without any firewall restrictions.

  • What was the end result from ssh-keyscan?
  • What did it print, if anything?
  • Does the telnet hang for several seconds? Do you get a connection refused or connection rejected response?
  • If you run netstat -an --tcp do you see several TCP entries that are in SYN_SENT state? If so, this would indicate there is something blocking at the network layer
3
  • Running telnet github.com 22 results in a 'Connection refused' message, which doesn't happen on the other servers. Running netstat -an --tcp does not reveal any SYN_STATE entries. As for the output of ssh-keyscan, there is absolutely no output -- no error messages, no warning messages, nothing. – Jay Feb 20 '17 at 21:54
  • If you're getting connection refused then you need to look into the network layer. Could your machine or LAN firewall be blocking? Could github.com be refusing? – Ed Neville Feb 20 '17 at 21:57
  • I don't think github.com is refusing, but thanks for your point in the right direction. Instead of looking on the machine itself, I suspect I now need to contact the network team to find out what's going on from their end. Thanks! – Jay Feb 20 '17 at 22:06
7

I had the same issue (no output being given) and it was because the default timeout (5 seconds) was too short. I resolved this by using the -T flag which allows me to set my own custom timeout (in seconds). Illustrative example with 240 second timeout and random IP address:

ssh-keyscan -T 240 52.213.86.118
1
  • This -- thank you. Feels like a bug that there's no error message on this. – Codebling Jan 13 at 22:40
3

Try running ssh-keyscan -p <PORT> <IP> if your ssh server is not running on default port

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.