Build-in ssh is missing: no logs when enabled, always gives permission denied #6495

New Issue

GiteaMirror · 2025-11-02T06:57:43-06:00

GiteaMirror commented

2025-11-02 06:57:43 -06:00

Originally created by @FredFoo on GitHub (Dec 10, 2020).

Gitea version (or commit ref): 1.13.0, upgrading from 1.9.3
Git version: 191
Operating system: Ubuntu 16.04
Database (use [x]):
- PostgreSQL
- [ x] MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- [x ] No
Log gist:

Description

The problem: Connection to build-in ssh always ends with permission denied (publickey) and no way to debug.

I am upgrading from 1.9.3 to the latest release. I had the build-in ssh working just fine, trace logs would show stuff about the server starting and the connections coming in.

I upgraded to 1.13.0 and it stopped working. Now I always get permission denied and not a single line of log, even on run mode dev and level trace. I tried the latest 1.12 and ran into the same problem. I did apply all the database migrations. If I go back to 1.9 and the database backup all is fine again.

I also tried the docker container and updated it to have the build-in ssh instead of opensshd - same problem.

Any ideas?
...

Screenshots

Originally created by @FredFoo on GitHub (Dec 10, 2020).   - Gitea version (or commit ref): 1.13.0, upgrading from 1.9.3 - Git version: 191 - Operating system: Ubuntu 16.04    - Database (use `[x]`): - [ ] PostgreSQL - [ x] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [x ] No - Log gist:    ## Description The problem: Connection to build-in ssh always ends with permission denied (publickey) and no way to debug. I am upgrading from 1.9.3 to the latest release. I had the build-in ssh working just fine, trace logs would show stuff about the server starting and the connections coming in. I upgraded to 1.13.0 and it stopped working. Now I always get permission denied and not a single line of log, even on run mode dev and level trace. I tried the latest 1.12 and ran into the same problem. I did apply all the database migrations. If I go back to 1.9 and the database backup all is fine again. I also tried the docker container and updated it to have the build-in ssh instead of opensshd - same problem. Any ideas? ... ## Screenshots

GiteaMirror added the type/question label 2025-11-02 06:57:43 -06:00

GiteaMirror closed this issue

2025-11-02 06:57:43 -06:00

GiteaMirror commented

2025-11-02 06:57:44 -06:00

@zeripath commented on GitHub (Dec 10, 2020):

Is your BUILTIN_SSH_SERVER_USER set correctly?

@zeripath commented on GitHub (Dec 10, 2020): Is your BUILTIN_SSH_SERVER_USER set correctly?

GiteaMirror commented

2025-11-02 06:57:44 -06:00

@FredFoo commented on GitHub (Dec 10, 2020):

I do guess so :) But I just set it to the same value as RUN_USER - the user I do want for this - and it changes nothing. Still no log entries even on trace level.

@FredFoo commented on GitHub (Dec 10, 2020): I do guess so :) But I just set it to the same value as RUN_USER - the user I do want for this - and it changes nothing. Still no log entries even on trace level.

GiteaMirror commented

2025-11-02 06:57:44 -06:00

@zeripath commented on GitHub (Dec 11, 2020):

From 1.10 (#7250) all ssh paths have to be:

$BUILTIN_SSH_SERVER_USER@$DOMAIN

Are you certain that you have that?

Have you checked with ssh -vvv that you're offering the correct key to gitea?

Have you ensured that the key you want to offer is one that is allowed by gitea's minimum key sizes?
https://docs.gitea.io/en-us/config-cheat-sheet/#ssh-minimum-key-sizes-sshminimum_key_sizes

@zeripath commented on GitHub (Dec 11, 2020): From 1.10 (#7250) all ssh paths have to be: $BUILTIN_SSH_SERVER_USER@$DOMAIN Are you certain that you have that? Have you checked with ssh -vvv that you're offering the correct key to gitea? Have you ensured that the key you want to offer is one that is allowed by gitea's minimum key sizes? https://docs.gitea.io/en-us/config-cheat-sheet/#ssh-minimum-key-sizes-sshminimum_key_sizes

GiteaMirror commented

2025-11-02 06:57:44 -06:00

@FredFoo commented on GitHub (Dec 11, 2020):

I might have figured this out on my own. in 1.9.3 I was able to connect with my own username and the keypair of which I added the public key to my own useraccount.

In 1.13.0 it only seems to work if instead of my own username I use the name of the server user, i.e. "git" and the keypair of which I added the public key to my own useraccount.

I at least can open a connection, have yet to try if the functionality is as expected.

I did not find any documentation about this. Is this change intended? Or is this configurable?

@FredFoo commented on GitHub (Dec 11, 2020): I might have figured this out on my own. in 1.9.3 I was able to connect with my own username and the keypair of which I added the public key to my own useraccount. In 1.13.0 it only seems to work if instead of my own username I use the name of the server user, i.e. "git" and the keypair of which I added the public key to my own useraccount. I at least can open a connection, have yet to try if the functionality is as expected. I did not find any documentation about this. Is this change intended? Or is this configurable?

GiteaMirror commented

2025-11-02 06:57:45 -06:00

@FredFoo commented on GitHub (Dec 11, 2020):

Anyways, seems there is not that much information about BUILTIN_SSH_SERVER_USER in the docs. And the change that you have to use the user defined with this variable to connect, not your own username anymore. Hope this helps should anyone stumble over it.

Beats me why there is no simple log message here. Something like log.warn("Invalid ssh username %s - use %s for all git operations via ssh", requestuser, setting.SSH.BuiltinServerUser). Would have helped me big time :)

@FredFoo commented on GitHub (Dec 11, 2020): Anyways, seems there is not that much information about BUILTIN_SSH_SERVER_USER in the docs. And the change that you have to use the user defined with this variable to connect, not your own username anymore. Hope this helps should anyone stumble over it. Beats me why there is no simple log message here. Something like log.warn("Invalid ssh username %s - use %s for all git operations via ssh", requestuser, setting.SSH.BuiltinServerUser). Would have helped me big time :)

GiteaMirror commented

2025-11-02 06:57:45 -06:00

@zeripath commented on GitHub (Dec 11, 2020):

Anyways, seems there is not that much information about BUILTIN_SSH_SERVER_USER in the docs. And the change that you have to use the user defined with this variable to connect, not your own username anymore. Hope this helps should anyone stumble over it.

This change was made almost a year and half ago in 1.10, as I said:

From 1.10 all ssh paths have to be:

$BUILTIN_SSH_SERVER_USER@$DOMAIN

I do recall mentioning the issue around the time of merging #7250 and suggested we gave (yet another) configuration option to allow the old behaviour but it was determined to be unnecessary. There has almost certainly been another issue report about it.

Beats me why there is no simple log message here. Something like log.warn("Invalid ssh username %s - use %s for all git operations via ssh", requestuser, setting.SSH.BuiltinServerUser). Would have helped me big time :)

PRs are welcome.

@zeripath commented on GitHub (Dec 11, 2020): > Anyways, seems there is not that much information about BUILTIN_SSH_SERVER_USER in the docs. And the change that you have to use the user defined with this variable to connect, not your own username anymore. Hope this helps should anyone stumble over it. This change was made almost a year and half ago in 1.10, as I said: > From 1.10 all ssh paths have to be: > > $BUILTIN_SSH_SERVER_USER@$DOMAIN I do recall mentioning the issue around the time of merging #7250 and suggested we gave (yet another) configuration option to allow the old behaviour but it was determined to be unnecessary. There has almost certainly been another issue report about it. > Beats me why there is no simple log message here. Something like log.warn("Invalid ssh username %s - use %s for all git operations via ssh", requestuser, setting.SSH.BuiltinServerUser). Would have helped me big time :) PRs are welcome.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#6495