I'm trying to set up an ssh connection from an OS X box provided by Travis CI to git-over-ssh at github.com.
Nothing fancy: my script takes a base64-encoded passwordless private key, decodes it and setups up the following git ssh wrapper to enforce key usage:
unset SSH_AGENT_PID SSH_AUTH_SOCK # Setting up bot key echo "$BOT_SSH_KEY" | base64 --decode >$HOME/bot_id chmod 600 $HOME/bot_id # Setting up ssh wrapper cat >$HOME/git-ssh <<__EOF__ #!/bin/sh -efx ssh -vv -i "$HOME/bot_id" "\$@" __EOF__ chmod a+x $HOME/git-ssh export GIT_SSH="$HOME/git-ssh"
Then it tries to do ssh-authenticated git clone, which, according to the logs, results in ssh client being called. The very same script works on Ubuntu Linux instances provided by Travis and fails on OS X instances:
Analyzing the logs, they both look very similar, expect for:
- Ubuntu uses OpenSSH_6.6.1, OS X uses OpenSSH_6.9p1 => kex_parse_kexinit lists slightly different set of ciphers available
- Ubuntu uses
/home/travis/bot_id, OS X uses
OS X issues extra warnings for not being able to see the public part of the key (probably not a big deal):
debug1: key_load_public: No such file or directory
Ubuntu suceeds after:
debug1: Server host key: RSA 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48 debug1: Host 'github.com' is known and matches the RSA host key. debug1: Found key in /home/travis/.ssh/known_hosts:2 Warning: Permanently added the RSA host key for IP address '220.127.116.11' to the list of known hosts. debug1: ssh_rsa_verify: signature correct debug2: kex_derive_keys debug2: set_newkeys: mode 1 debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug2: set_newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug2: key: /home/travis/bot_id ((nil)), explicit debug1: Authentications that can continue: publickey debug1: Next authentication method: publickey debug1: Trying private key: /home/travis/bot_id debug1: key_parse_private2: missing begin marker debug1: read PEM private key done: type RSA debug2: we sent a publickey packet, wait for reply debug1: Authentication succeeded (publickey). Authenticated to github.com ([18.104.22.168]:22). ...
OS X fails with:
debug1: Server host key: ssh-rsa SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8 debug1: read_passphrase: can't open /dev/tty: Device not configured debug1: permanently_drop_suid: 501 ssh_askpass: exec(/usr/X11R6/bin/ssh-askpass): No such file or directory Host key verification failed. fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists.
As far as I understand, ssh client should at the very least (1) connect, (2) verify server's keys and identity, (3) start trying various auth methods. From what I see, OS X gets the connection, but then does not even try to do any verifications (or complain about RSA checks failed, or whatever), but somehow bypasses all pre-set auth methods (i.e. passwordless key) and directly proceeds to "ask authentication information interactively" method => and then fails, as it's obviously disabled, as CI is not an interactive server.
Any ideas what's wrong with OS X ssh and how to get it to work, or at least add some debug? As my guesses go, probably it somehow silently fails on server's identity check, but I have no idea how to debug that (especially given that I don't have any OS X boxes handy to try it interactively).