gitwindows-subsystem-for-linuxgit-configssh-configdeploy-keys

Git over ssh is ignoring the ssh config


So, I've been messing around with this for a little while now, but git is still acting up. While ssh works just fine now, git is seemingly ignoring my ssh config but I at least know it works when I specify the port and key with a sshCommand in the .git/config in the repository in question.

Pure ssh works just fine using the config file, however, I'm using Github deploy keys, so my ssh config looks more like this:

host test
        Hostname ssh.github.com
        User git
        Port 443
        IdentityFile ~/.ssh/id_ed25519-test.github
        IdentitiesOnly yes
host test2
        Hostname ssh.github.com
        User git
        Port 443
        IdentityFile ~/.ssh/id_ed25519-test2.github
        IdentitiesOnly yes

Still haven't had any problems connecting using ssh, but I think my problems come down to some misunderstanding I have over how host and hostname work, probably? Not really sure, nothing really stood out from the man page for ssh_config and ssh.

Due to work related reasons, primarily that our VPN is kinda wonky, I need to use port 443.

Strangely, ssh does not work using github.com as the Hostname, only when it is ssh.github.com. I had problems connecting to it, and just came across that in an example in Github's docs but otherwise not mentioned. Tested with it and it has worked fine since.

This also plays into the remote in the git repo, as I need to append ssh. there too. git remote add orgin git@github.com:user/test.git does not work but git remote origin2 git@ssh.github.com:user/test.git does. I've tested if git can connect by running git remote show <remote> and replacing <remote> with either origin or origin2.

However, without specifying the sshCommand to be sshCommand = ssh -p 443 -i ~/.ssh/id_ed25519-test.github, it will not connect.

I've tried debugging using this:

GIT_TRACE=true \                                                                  at 11:17:27
GIT_CURL_VERBOSE=true \
GIT_SSH_COMMAND="ssh -vvv" \
GIT_TRACE_PACK_ACCESS=true \
GIT_TRACE_PACKET=true \
GIT_TRACE_PACKFILE=true \
GIT_TRACE_PERFORMANCE=true \
GIT_TRACE_SETUP=true \
GIT_TRACE_SHALLOW=true \
git remote show <remote>

While using git, though I've sometimes removed the GIT_SSH_COMMAND="ssh -vvv" \ part of it since it seems to overwrite the git config file, which isn't that surprising I suppose.

If I specify the key in the debug ssh_command, it at least chooses that one, but it is still trying to connect to Github over port 22. Here is the log:

11:20:17.116821 trace.c:375             setup: git_dir: .git
11:20:17.116867 trace.c:376             setup: git_common_dir: .git
11:20:17.116872 trace.c:377             setup: worktree: /home/user/code/test
11:20:17.116874 trace.c:378             setup: cwd: /home/user/code/test
11:20:17.116877 trace.c:379             setup: prefix: (null)
11:20:17.116879 git.c:439               trace: built-in: git remote show test
11:20:17.117075 run-command.c:663       trace: run_command: unset GIT_PREFIX; 'ssh -vvv' git@ssh.github.com 'git-upload-pack '\''github-user/test.git'\'''
OpenSSH_8.2p1 Ubuntu-4ubuntu0.1, OpenSSL 1.1.1f  31 Mar 2020
debug1: Reading configuration data /home/user/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug2: resolving "ssh.github.com" port 22
debug2: ssh_connect_direct
debug1: Connecting to ssh.github.com [140.82.121.35] port 22.
debug1: Connection established.
debug1: identity file /home/user/.ssh/id_rsa type -1
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: identity file /home/user/.ssh/id_dsa type -1
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/user/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/user/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/user/.ssh/id_ed25519 type -1
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: identity file /home/user/.ssh/id_ed25519_sk type -1
debug1: identity file /home/user/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/user/.ssh/id_xmss type -1
debug1: identity file /home/user/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.1

As you can see, it completely skips over the ~/.ssh/config definitions. Even if I specify it in the ssh command, it ignores it. Which is what leads me to believe I have some misunderstanding about how host and hostname works, or there is some unspoken behavior, that causes this.

I have also used ssh -vvvT <remote> to get the most verboseness possible, and like mentioned earlier, normal ssh works completely fine. Regardless of where I am in the directory tree when the command is run, regardless of which host I'm calling, it works perfectly fine. Which is why I'm confused because it doesn't work when git is involved in the process.

There is also only OpenSSH installed, so it shouldn't be a conflicting ssh client I'd assume.

For now, I get by with simply adding an sshCommand per repo git config, however, by doing this there is little point in actually having an ssh config when it isn't used for much since Github doesn't support shell access and on work my machine isn't used for any other proper ssh-ing at the moment.

I've been scratching my head over this for the last two weeks or so, but I've half given up and decided to at least try posting a question about this since the others like this ones like this one (in title at least) have not solved my issue. Hopefully someone here knows what is wrong and can tell me how to fix it or at least point me towards some documentation or something that explains what I'm doing wrong.


Solution

  • As I assumed, it was a misunderstanding based in the nature between the host and hostname in relation to a git remote. Though honestly, I did not really find it explained properly that this is how they interact with each other.

    Like I mentioned in the first post, I had to append ssh. to the otherwise normal git@github.com:user/repo, however it is not necessary to use the github.com or ssh.github.com in the remote link because it will be defined in your .ssh/config.

    If your .ssh/config is:

    host test
            Hostname ssh.github.com
            User git
            Port 443
            IdentityFile ~/.ssh/id_ed25519-test.github
            IdentitiesOnly yes
    

    And your GitHub username is user and your repository is test, your git remote will not be git@github.com:user/test.git or git@ssh.github.com:user/test.git. It will be git@test:user/test (in this example). In other words: git@<ssh config host>:<username on remote>/<remote repo name>, this is because when it calls the .ssh/config host it actually reads the hostname defined under the host configuration.

    One final thing to note is that in my case, due to how our network is set up and how the VPN interacts with it, I still need to use ssh.github.com as the hostname and port 443 to be able to connect.