Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Have 3 servers: Local, Bare, Development.

The following workflow works perfectly:

1. Make my local changes 
2. git push to Bare 
3. ssh into Bare 
4. $ ssh ip.of.Development.server "cd /path/to/Development/repo; git pull"

This does exactly what you would expect, content gets pulled to my Development server, displays on the page, all is well.

However, if I move the last line to my hooks/post-receive file on Bare, I get a

remote: Host key verification failed.

I can ssh from Development to Bare without issue and without using a password (after I set up an RSA pair).

Even if I cut the post-receive hook down to just

ssh ip.of.Development.server

I get the same error, but if I enter this exact same line on the command line, it works fine.

share|improve this question
2  
What user does the hook run under? Has the keypair been installed in the ~/.ssh folder for that user? Has the devel server been added to that user's known_hosts file? Can you pipe the stdout and stderr of the hook to a file? –  jimbobmcgee Jan 14 '13 at 22:32
    
I'm not sure how to check what the hook runs under. I first assumed root, but that wouldn't make much sense, so now I'm thinking it runs under gitdaemon, whereas I installed the keypair for root and added the devel server for root as well. –  Nick Brown Jan 14 '13 at 22:58
1  
You might be able to supply a common private key with (I think) -i and possibly bypass known_host checks with a -o option (I think you have to tell it the fingerprint to expect). I'd get the script output piping out to a file, first, e.g. >> /var/log/post-receive 2>&1 to make sure it is definitely this issue? –  jimbobmcgee Jan 14 '13 at 23:09
1  
Also, I don't know much about git, but if it works at all like Subversion and you are tunnelling your access to bare over SSH (in Subversion, it would be by using the svn+ssh://server/path URL) the process is probably run under bare's authenticating SSH user (in Subversion, svnserve will be started by the authenticating SSH user, which will do the commit and run the hooks). –  jimbobmcgee Jan 14 '13 at 23:12
    
You were correct, it was running under the wrong user. I performed an 'echo $USER' in the post-hook script to nail it down. Thanks for the assistance. –  Nick Brown Jan 15 '13 at 22:57
add comment

1 Answer

up vote 0 down vote accepted

Inside the "bare" server you should edit the ~/.ssh/known_hosts file of the user that's running the hook.

Example of a line of ~/.ssh/known_hosts:

192.168.1.9 ssh-rsa AAAB3NzaC1yc2EAAAADAQABAAABAQDM5bg362+EqiRioaVO5f7L7a4NK94yHI6HXQCdge7WvmN9AFVhruXs31JUooxTD0tMe3nE0zDIt9fBcoIXNYjd2auCrRdT/2kvNg12aqhJpoxKeArekjQ10xmyjkDGQr6DUTzW7TOX55aucDbftO1chQ6+wG7mpvkE6N0J9HsQvJrjb3LO9JlEDCYFp2sSx3OxvCl33pEMk7zVhHftqP8hmZnQF8Y2/dO/nK/UawJVOVzyvImzvOhBFqKYgVIKajtjH/yodf9R1tOALqP9QQVBA9zJOLhc4q6Rcj3QVb+o6mv3Zl5QudZP6ATcFeKZPzEEUrqHbeQiZ2Ce72AUtD+7

You should remove the line that identifies the server that you're trying to connect to and then, BEFORE launching again your script, do a "ssh user@destination" with your user so that the destination server's host key to your known_hosts file. Like this:

localhost% ssh user@destination The authenticity of host 'destination (10.0.0.1)' can't be established. RSA key fingerprint is 51:a4:73:ef:6d:b6:40:c1:a2:1f:ba:33:a0:64:c0:f8. Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'destination' (RSA) to the list of known hosts.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.