Home / server / Questions / 1045777
In Process
Karoh
Asked: 2020-12-11 19:55:51 +0800 CST

Do I need to have my private ssh key stored on my server in order to git clone repos while ssh'd into the server?

  • 772

  1. I generated my ssh key on my local machine.

  2. I then used the following command to copy my public key onto my server: ssh-copy-id username@remote_host. That went smoothly.

  3. I have confirmed that my local machine's ~/.ssh/id_rsa.pub has been copied onto my server at my_user's_home_directory/.ssh/authorized_keys. There are no other files in there.

  4. I've also copied that same public key into Gitlab.

  5. When I try to git clone a repo onto the server, I'm told:

[email protected]: Permission denied (publickey,keyboard-interactive).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
  1. I can ssh easily enough into my server. But since my server doesn't hold my private key, it sort of makes sense to me that I wouldn't be able to ssh git clone. What's the normal procedure here? I can do a regular https download, is that the standard route?
ubuntu ssh git gitlab github

2 Answers

  1. You can use ssh -A to forward your ssh-agent to the remote host which will use your local keys from the remote server without sending the keys themselves.

    While this seems like a secure option, only do this if you absolutely trust the remote server (ie. don't enable this by default). The forwarded ssh-agent can be used by anyone with the same remote user as yours or with root privileges.

    If you decide to go that way, I'd recommend adding keys to the agent with ssh-add -c so you're prompted for confirmation when a key is used.

    • 3

  2. git is decentralized. Could fetch from Gitlab to your PC, then push from your PC to the server. ssh client is your PC for both, so your private key or forwarded agent doesn't touch the server.

    Or, could have multiple ssh keys. A personal one for your PC, and a different one for the server. More keys to manage, but possible to monitor and control separately, service account style.

    Or, don't use git as a deployment tool. Generate a package or some other archive, and install that like you do other software.

    • 0