dc4f8d1723
Most documentation assumed the use of SSH public key authentication. This change removes that assumption and adds some hints on client configuration with OpenSSH and kerberos. Change-Id: I4d5654a088a68afd740d3e4e91eaf15d0bbf58b1
82 lines
2.9 KiB
Plaintext
82 lines
2.9 KiB
Plaintext
= Permission denied (publickey)
|
|
|
|
With this error message an SSH command to Gerrit is rejected if the
|
|
SSH authentication is not successful.
|
|
|
|
The link:http://en.wikipedia.org/wiki/Secure_Shell[SSH] protocol can use
|
|
link:http://en.wikipedia.org/wiki/Public-key_cryptography[Public-key Cryptography]
|
|
for authentication.
|
|
In general configurations, Gerrit will authenticate you by the public keys
|
|
known to you. Optionally, it can be configured by the administrator to allow
|
|
for link:config-gerrit.html#sshd.kerberosKeytab[kerberos] authentication
|
|
instead.
|
|
|
|
In any case, verify that you are using the correct username for the SSH command
|
|
and that it is typed correctly (case sensitive). You can look up your username
|
|
in the Gerrit Web UI under 'Settings' -> 'Profile'.
|
|
|
|
If you are facing this problem and using an SSH keypair, do the following:
|
|
|
|
. Verify that you have uploaded your public SSH key for your Gerrit
|
|
account. To do this go in the Gerrit Web UI to 'Settings' ->
|
|
'SSH Public Keys' and check that your public SSH key is there. If
|
|
your public SSH key is not there you have to upload it.
|
|
. Verify that you are using the correct private SSH key. To find out
|
|
which private SSH key is used test the SSH authentication as
|
|
described below. From the trace you should see which private SSH
|
|
key is used.
|
|
|
|
Debugging kerberos issues can be quite hard given the complexity of the
|
|
protocol. In case you are using kerberos authentication, do the following:
|
|
|
|
. Verify that you have acquired a valid initial ticket. On a Linux machine, you
|
|
can acquire one using the `kinit` command. List all your tickets using the
|
|
`klist` command. It should list all principals for which you have acquired a
|
|
ticket and include a principal name corresponding to your Gerrit server, for
|
|
example `HOST/gerrit.mydomain.tld@MYDOMAIN.TLD`.
|
|
Note that tickets can expire and require you to re-run `kinit` periodically.
|
|
. Verify that your SSH client is using kerberos authentication. For OpenSSH
|
|
clients this can be controlled using the `GSSAPIAuthentication` setting.
|
|
For more information see
|
|
link:user-upload.html#configure_ssh_kerberos[SSH kerberos configuration].
|
|
|
|
== Test SSH authentication
|
|
|
|
To test the SSH authentication you can run the following SSH command.
|
|
This command will print out a detailed trace which is helpful to
|
|
analyze problems with the SSH authentication:
|
|
|
|
----
|
|
$ ssh -vv -p 29418 john.doe@git.example.com
|
|
----
|
|
|
|
If the SSH authentication is successful you should find the following
|
|
lines in the output:
|
|
|
|
----
|
|
...
|
|
|
|
debug1: Authentication succeeded (publickey).
|
|
|
|
...
|
|
|
|
**** Welcome to Gerrit Code Review ****
|
|
|
|
Hi John Doe, you have successfully connected over SSH.
|
|
|
|
Unfortunately, interactive shells are disabled.
|
|
To clone a hosted Git repository, use:
|
|
|
|
git clone ssh://john.doe@git.example.com:29418/REPOSITORY_NAME.git
|
|
|
|
...
|
|
----
|
|
|
|
|
|
GERRIT
|
|
------
|
|
Part of link:error-messages.html[Gerrit Error Messages]
|
|
|
|
SEARCHBOX
|
|
---------
|