permission denied on git.trac

[Vincent Delecroix]

Hello,

Trying to fetch or push to the git server I today get

$ git fetch
g...@trac.sagemath.org: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.


I did not change any ssh key on my computer. Though,
I did reupload them to the trac server user interface
in case something was lost somewhere. But the problem
persists.

Any idea?

Best
Vincent

[Dima Pasechnik]

On Thu, Nov 25, 2021 at 11:08 AM Vincent Delecroix

recently discussed here:
https://groups.google.com/g/sage-devel/c/7rGuosozeO0/m/8HKnDAi1AgAJ

TL;DR: Either you have very a very old key, of type no longer accepted
by sshd (and so you need to upload a better key), or there is
blacklisting.
I'll reboot the trac server soon, this seems to help with blacklisting.

Dima




> Any idea?
>
> Best
> Vincent
>
> --
> You received this message because you are subscribed to the Google Groups "sage-devel" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to sage-devel+...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/sage-devel/935d0579-787f-6f6f-ede4-d09c3eb5034b%40gmail.com.

[Vincent Delecroix]

Le 25/11/2021 à 12:18, Dima Pasechnik a écrit :
> On Thu, Nov 25, 2021 at 11:08 AM Vincent Delecroix
> <20100.d...@gmail.com> wrote:
>>
>> Hello,
>>
>> Trying to fetch or push to the git server I today get
>>
>> $ git fetch
>> g...@trac.sagemath.org: Permission denied (publickey).
>> fatal: Could not read from remote repository.
>>
>> Please make sure you have the correct access rights
>> and the repository exists.
>>
>>
>> I did not change any ssh key on my computer. Though,
>> I did reupload them to the trac server user interface
>> in case something was lost somewhere. But the problem
>> persists.
>>
> recently discussed here:
> https://groups.google.com/g/sage-devel/c/7rGuosozeO0/m/8HKnDAi1AgAJ
>
> TL;DR: Either you have very a very old key, of type no longer accepted
> by sshd (and so you need to upload a better key), or there is
> blacklisting.
> I'll reboot the trac server soon, this seems to help with blacklisting.

What is a "very old key"? A ssh key is not supposed to become obsolete.

I did upload a new ssh key and nothing changed as far as "git fetch"
is concerned.

Best
Vincent

[Vincent Delecroix]

All my keys were ssh-rsa. It appears that some server
thinks it is not secure enough. Maybe it is the case
for our git.trac. At least, I generated a ed25519 key
and it now works.

Vincent

[Nils Bruin]

https://www.openssh.com/txt/release-8.8 mentions ssh-rsa is now disabled by default, because the method is based on SHA-1 which is seriously not secure anymore. It could be that sage-trac was updated to a newer version of openssh, but I suspect it works in both directions: openssh would probably also refuse to serve ssh-rsa certificates by default, so it could also be an update on your own computer that causes this.