3

I know what this error means, and usually I just remove that entry from the known_hosts file and get on with it (when I know why the verification is failing).

This time I still got the error after removing the specific entry for the host from known_hosts, so I removed all the entries and still got the error, then removed the entire known_hosts file and still get the error?!

I'm having this issue on all hosts.

I just moved .ssh to .ssh-bak, copied my keys into the new directory and still got the error.

What is the cause of this?

$ ssh -vvv git@github.com
OpenSSH_7.3p1, LibreSSL 2.4.1
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 20: Applying options for *
debug2: resolving "github.com" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to github.com [192.30.253.113] port 22.
debug1: Connection established.
debug1: identity file /Users/herbert/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/herbert/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/herbert/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/herbert/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/herbert/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/herbert/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/herbert/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/herbert/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.3
debug1: Remote protocol version 2.0, remote software version libssh-0.7.0
debug1: no match: libssh-0.7.0
debug2: fd 5 setting O_NONBLOCK
debug1: Authenticating to github.com:22 as 'git'
debug3: hostkeys_foreach: reading file "/Users/herbert/.ssh/known_hosts"
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-dss,ssh-rsa
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc
debug2: MACs ctos: hmac-sha1,hmac-sha2-256,hmac-sha2-512
debug2: MACs stoc: hmac-sha1,hmac-sha2-256,hmac-sha2-512
debug2: compression ctos: none,zlib,zlib@openssh.com
debug2: compression stoc: none,zlib,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ssh-rsa
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ssh-rsa SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8
debug3: hostkeys_foreach: reading file "/Users/herbert/.ssh/known_hosts"
debug3: hostkeys_foreach: reading file "/Users/herbert/.ssh/known_hosts"
Host key verification failed.

$ ssh -G github.com
user herbert
hostname github.com
port 22
addressfamily any
batchmode yes
canonicalizefallbacklocal yes
canonicalizehostname false
challengeresponseauthentication yes
checkhostip yes
compression no
controlmaster false
enablesshkeysign no
clearallforwardings no
exitonforwardfailure no
fingerprinthash SHA256
forwardagent no
forwardx11 no
forwardx11trusted no
gatewayports no
gssapiauthentication no
gssapidelegatecredentials no
hashknownhosts no
hostbasedauthentication no
identitiesonly no
kbdinteractiveauthentication yes
nohostauthenticationforlocalhost no
passwordauthentication yes
permitlocalcommand no
protocol 2
proxyusefdpass no
pubkeyauthentication yes
requesttty auto
rhostsrsaauthentication no
rsaauthentication yes
streamlocalbindunlink no
stricthostkeychecking ask
tcpkeepalive yes
tunnel false
useprivilegedport no
verifyhostkeydns false
visualhostkey no
updatehostkeys false
canonicalizemaxdots 1
compressionlevel 6
connectionattempts 1
forwardx11timeout 1200
numberofpasswordprompts 3
serveralivecountmax 3
serveraliveinterval 0
ciphers chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
hostkeyalgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
hostbasedkeytypes ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
kexalgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
loglevel INFO
macs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
pubkeyacceptedkeytypes ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
xauthlocation xauth
identityfile ~/.ssh/id_rsa
identityfile ~/.ssh/id_dsa
identityfile ~/.ssh/id_ecdsa
identityfile ~/.ssh/id_ed25519
canonicaldomains
globalknownhostsfile /etc/ssh/ssh_known_hosts /etc/ssh/ssh_known_hosts2
userknownhostsfile ~/.ssh/known_hosts ~/.ssh/known_hosts2
sendenv LANG
sendenv LC_*
connecttimeout none
tunneldevice any:any
controlpersist no
escapechar ~
ipqos lowdelay throughput
rekeylimit 0 0
streamlocalbindmask 0177

Almost everything in dev has these permissions:

0 crw-rw-rw- 1 root wheel 2, 0 22 Mar 10:07 tty 

Could these 4 have something to do with it?

0 crw--w---- 1 herbert tty 16, 0 12 Mar 12:55 ttys000 
0 crw--w---- 1 herbert tty 16, 1 22 Mar 15:12 ttys001 
0 crw--w---- 1 herbert tty 16, 2 22 Mar 15:14 ttys002 
0 crw--w---- 1 herbert tty 16, 3 22 Mar 17:44 ttys003 
0 crw--w---- 1 herbert tty 16, 4 22 Mar 17:44 ttys004


$ ls -lsa ~/.ssh
total 24 
0 drwx------ 5 herbert staff 170 22 Mar 15:39 . 
0 drwxr-xr-x+ 114 herbert staff 3876 22 Mar 15:29 .. 
8 -rw------- 1 herbert staff 1675 22 Mar 15:31 id_rsa 
8 -rw-r--r-- 1 herbert staff 414 22 Mar 15:31 id_rsa.pub 
8 -rw-r--r-- 1 herbert staff 848 22 Mar 16:42 known_hosts
  • Post the whole error message or the log with ssh -vvv server. – Jakuje Mar 22 '17 at 19:53
  • Added the output – Copenhagen Mar 22 '17 at 20:01
  • It looks like there is somewhere set that it should not ask for the verification. What is the output of ssh -G github.com ? – Jakuje Mar 22 '17 at 20:05
  • the globalknownhostsfile doesn't exist. Nor does ~/.ssh/known_hosts2 (is that standard?) – Copenhagen Mar 22 '17 at 20:09
  • Added the requested output above – Copenhagen Mar 22 '17 at 20:24
0

(from chat) As a workaround, you can download the public key from github using

ssh-keyscan github.com > ~/.ssh/known_hosts

But I ran out of ideas what is the underlying problem can be since both the configuration and the debug logs look good to me.

  • Since it's happening for all hosts I think I need to get to the bottom of it. – Copenhagen Mar 22 '17 at 21:33
0

Is it possible this answer resolves your issue? Replicated here in the interest of completeness:

Try sudo chmod 666 /dev/tty to give proper permissions to /dev/tty - which may have inadvertently been changed. If you want to beforehand you can ls -la /dev/tty to check the current permissions and see if they're already rw-rw-rw.

  • Almost everything in dev has these permissions: 0 crw-rw-rw- 1 root wheel 2, 0 22 Mar 10:07 tty Could these 4 have something to do with it? 0 crw--w---- 1 herbert tty 16, 0 12 Mar 12:55 ttys000 0 crw--w---- 1 herbert tty 16, 1 22 Mar 15:12 ttys001 0 crw--w---- 1 herbert tty 16, 2 22 Mar 15:14 ttys002 0 crw--w---- 1 herbert tty 16, 3 22 Mar 17:44 ttys003 0 crw--w---- 1 herbert tty 16, 4 22 Mar 17:44 ttys004 – Copenhagen Mar 22 '17 at 21:47
  • Those also were changed fairly recently – Copenhagen Mar 22 '17 at 21:51
  • Everything in that directory has a changed date of March 12 which was ten days ago – Copenhagen Mar 22 '17 at 22:00
  • It seems random, but have you tried booting into recovery mode (Cmd-R at boot) and repairing disk permissions on your drive? It's possible you have some low level things a little messed up and this might straighten it out. It could be related to what I posted above without actually being that file. – jimmy0x52 Mar 22 '17 at 22:01
  • I was starting to think about doing a system reinstall but I'll try a permissions repair first... though I'd like to wait and see if a solution can be found here, it's an interesting problem. – Copenhagen Mar 22 '17 at 22:02
0

Since Sierra has removed permissions repair I could only try disk repair which while successful, did not fix the problem. Though less satisfying than finding the cause would have been, rebooting into recovery mode and reinstalling Sierra did remove the problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .