3

I'm trying to ssh from server 1 to server 2 and do a git pull from server 1 to server 2.

So on server 1, I run the following command:

ssh root@server2 'cd /root/.example; git pull origin master'

but that gives me this error:

Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights

It's able to ssh because when I do an ls (ssh root@server2 'cd /root/.example; ls) I see the contents of the /root/.example directory. It's just not able to do a git pull origin master because it uses the wrong key.

What can I do differently?

I'm using Centos 6.

1
  • 1
    I do not see, how this is related. Your login on root@server2 works just fine, your git pull ON server2 does not. So it looks like you're lacking the rights to pull from origin (can you add from where you pull to the question?). If it should work with your ssh key, make sure you're using agent forwarding correctly (ssh -A may be required).
    – allo
    Oct 2, 2017 at 14:44

2 Answers 2

1

You need to ssh to user who has access to git repository. If you're ssh-ing to root, make sure root has at least riead rights to repo (in case you're using some smart version of git, like gitolite, gitlab and so on).

BTW if you're trying to make release with this, use git fetch && git reset --hard origin/master instead of git pull. Git pull makes merge and it can ends with conflicts, git reset just move actual head pointer to different commit without merging anythig.

0

SSH Agent forwarding

ssh doesn't do agent forwarding by default. So although on your client you loaded your ssh key with ssh-agent, that same key isn't available to "resuse" on the remote machine in the ssh session.

You can manually make it available on the destination by using the -A, but first read the security warnings in the man page (below)

Following uses agent forwarding, can ssh to github on remote. If remote host is in attacker control, they could use your ssh agent to "act as you" to other systems:

ssh -A root@server2

man ssh:

-A Enables forwarding of connections from an authentication agent such as ssh-agent(1). This can also be specified on a per-host basis in a configuration file.

Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent. A safer alternative may be to use a jump host (see -J).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .