0

I am setting up a new Ubuntu LTS 24.04 server to take over as my Laravel host. Working on the connectivity of this new box with GitHub, but I am in a tangle. I created a ssh key with ssh-keygen -t ed25519 -C "laravel2025-h1".

ssh-add -l confirms it's existence.

256 SHA256:tTE0uTBM3XJuHP5eDi2Di4pwLS2sxxihMhtHYXv+1YM laravel2025-h1 (ED25519)

The first problem was the Unable to negotiate with 140.82.112.3 port 22: no matching host key type found. Their offer: ssh-rsa. I seemingly resolved this by adding a ~/.ssh/config file with the HostKeyAlgorithms and PubkeyAcceptedAlgorithms lines as the internet suggested:

Host github
  HostName github.com
  User git
  HostKeyAlgorithms +ssh-rsa
  PubkeyAcceptedAlgorithms +ssh-rsa

After this, the connection continued onto a different error.

Running ssh -v github generated this output

OpenSSH_9.6p1 Ubuntu-3ubuntu13.13, OpenSSL 3.0.13 30 Jan 2024
debug1: Reading configuration data /var/www/my_domain/.ssh/config
debug1: /var/www/my_domain/.ssh/config line 1: Applying options for github
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: Connecting to github.com [140.82.114.4] port 22.
debug1: Connection established.
debug1: identity file /var/www/my_domain/.ssh/id_rsa type -1
debug1: identity file /var/www/my_domain/.ssh/id_rsa-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_ecdsa type -1
debug1: identity file /var/www/my_domain/.ssh/id_ecdsa-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_ecdsa_sk type -1
debug1: identity file /var/www/my_domain/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_ed25519 type -1
debug1: identity file /var/www/my_domain/.ssh/id_ed25519-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_ed25519_sk type -1
debug1: identity file /var/www/my_domain/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_xmss type -1
debug1: identity file /var/www/my_domain/.ssh/id_xmss-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_dsa type -1
debug1: identity file /var/www/my_domain/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.13
debug1: Remote protocol version 2.0, remote software version libssh_0.9.0
debug1: compat_banner: no match: libssh_0.9.0
debug1: Authenticating to github.com:22 as 'git'
debug1: load_hostkeys: fopen /var/www/my_domain/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: ecdh-sha2-nistp256
debug1: kex: host key algorithm: ssh-rsa
debug1: kex: server->client cipher: aes128-ctr MAC: [email protected] compression: none
debug1: kex: client->server cipher: aes128-ctr MAC: [email protected] compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-rsa SHA256:7zYnlSpxx6z0t477lR5vNYfelxewzWwu8N1X6v+wsZA
debug1: load_hostkeys: fopen /var/www/my_domain/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host 'github.com' is known and matches the RSA host key.
debug1: Found key in /var/www/my_domain/.ssh/known_hosts:1
debug1: rekey out after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 4294967296 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_ext_info_client_parse: server-sig-algs=<ssh-rsa,ssh-dss>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: get_agent_identities: bound agent to hostkey
debug1: get_agent_identities: agent returned 1 keys
debug1: Will attempt key: laravel2025-h1 ED25519 SHA256:tTE0uTBM3XJuHP5eDi2Di4pwLS2sxxihMhtHYXv+1YM agent
debug1: Will attempt key: /var/www/my_domain/.ssh/id_rsa
debug1: Will attempt key: /var/www/my_domain/.ssh/id_ecdsa
debug1: Will attempt key: /var/www/my_domain/.ssh/id_ecdsa_sk
debug1: Will attempt key: /var/www/my_domain/.ssh/id_ed25519
debug1: Will attempt key: /var/www/my_domain/.ssh/id_ed25519_sk
debug1: Will attempt key: /var/www/my_domain/.ssh/id_xmss
debug1: Will attempt key: /var/www/my_domain/.ssh/id_dsa
debug1: Offering public key: laravel2025-h1 ED25519 SHA256:tTE0uTBM3XJuHP5eDi2Di4pwLS2sxxihMhtHYXv+1YM agent
debug1: Server accepts key: laravel2025-h1 ED25519 SHA256:tTE0uTBM3XJuHP5eDi2Di4pwLS2sxxihMhtHYXv+1YM agent
debug1: Authentications that can continue: publickey
debug1: Trying private key: /var/www/my_domain/.ssh/id_rsa
debug1: Trying private key: /var/www/my_domain/.ssh/id_ecdsa
debug1: Trying private key: /var/www/my_domain/.ssh/id_ecdsa_sk
debug1: Trying private key: /var/www/my_domain/.ssh/id_ed25519
debug1: Trying private key: /var/www/my_domain/.ssh/id_ed25519_sk
debug1: Trying private key: /var/www/my_domain/.ssh/id_xmss
debug1: Trying private key: /var/www/my_domain/.ssh/id_dsa
debug1: No more authentication methods to try.
[email protected]: Permission denied (publickey).

Here are lines that let me know it is trying to work, but I cannot figure out what is failing and why:

...
debug1: Authenticating to github.com:22 as 'git'
...
debug1: Will attempt key: laravel2025-h1 ED25519 SHA256:tTE0uTBM3XJuHP5eDi2Di4pwLS2sxxihMhtHYXv+1YM agent
...
debug1: Offering public key: laravel2025-h1 ED25519 SHA256:tTE0uTBM3XJuHP5eDi2Di4pwLS2sxxihMhtHYXv+1YM agent
debug1: Server accepts key: laravel2025-h1 ED25519 SHA256:tTE0uTBM3XJuHP5eDi2Di4pwLS2sxxihMhtHYXv+1YM agent
debug1: Authentications that can continue: publickey
...
[email protected]: Permission denied (publickey).

My key file is in GitHub and can be verified via the ssh256 signature.

screenshot of my key in GitHub

What am I doing wrong? Is my named key the cause? Is the key algorithms still causing trouble?

EDIT
Here is the output of ssh -vvv github



OpenSSH_9.6p1 Ubuntu-3ubuntu13.13, OpenSSL 3.0.13 30 Jan 2024
debug1: Reading configuration data /var/www/my_domain/.ssh/config
debug1: /var/www/my_domain/.ssh/config line 1: Applying options for github
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/var/www/my_domain/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/var/www/my_domain/.ssh/known_hosts2'
debug2: resolving "github.com" port 22
debug3: resolve_host: lookup github.com:22
debug3: channel_clear_timeouts: clearing
debug3: ssh_connect_direct: entering
debug1: Connecting to github.com [140.82.112.3] port 22.
debug3: set_sock_tos: set socket 3 IP_TOS 0x10
debug1: Connection established.
debug1: identity file /var/www/my_domain/.ssh/id_rsa type -1
debug1: identity file /var/www/my_domain/.ssh/id_rsa-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_ecdsa type -1
debug1: identity file /var/www/my_domain/.ssh/id_ecdsa-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_ecdsa_sk type -1
debug1: identity file /var/www/my_domain/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_ed25519 type -1
debug1: identity file /var/www/my_domain/.ssh/id_ed25519-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_ed25519_sk type -1
debug1: identity file /var/www/my_domain/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_xmss type -1
debug1: identity file /var/www/my_domain/.ssh/id_xmss-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_dsa type -1
debug1: identity file /var/www/my_domain/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.13
debug1: Remote protocol version 2.0, remote software version libssh_0.9.0
debug1: compat_banner: no match: libssh_0.9.0
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to github.com:22 as 'git'
debug3: record_hostkey: found key type RSA in file /var/www/my_domain/.ssh/known_hosts:1
debug3: load_hostkeys_file: loaded 1 keys from github.com
debug1: load_hostkeys: fopen /var/www/my_domain/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],[email protected],rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: [email protected],curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,[email protected]
debug2: host key algorithms: [email protected],[email protected],rsa-sha2-512,rsa-sha2-256,ssh-rsa,[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected]
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa
debug2: ciphers ctos: [email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc
debug2: ciphers stoc: [email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc
debug2: MACs ctos: [email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none
debug2: compression stoc: none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: ecdh-sha2-nistp256
debug1: kex: host key algorithm: ssh-rsa
debug1: kex: server->client cipher: aes128-ctr MAC: [email protected] compression: none
debug1: kex: client->server cipher: aes128-ctr MAC: [email protected] compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-rsa SHA256:7zYnlSpxx6z0t477lR5vNYfelxewzWwu8N1X6v+wsZA
debug3: record_hostkey: found key type RSA in file /var/www/my_domain/.ssh/known_hosts:1
debug3: load_hostkeys_file: loaded 1 keys from github.com
debug1: load_hostkeys: fopen /var/www/my_domain/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host 'github.com' is known and matches the RSA host key.
debug1: Found key in /var/www/my_domain/.ssh/known_hosts:1
debug3: send packet: type 21
debug2: ssh_set_newkeys: mode 1
debug1: rekey out after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: ssh_set_newkeys: mode 0
debug1: rekey in after 4294967296 blocks
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug3: kex_input_ext_info: extension server-sig-algs
debug1: kex_ext_info_client_parse: server-sig-algs=<ssh-rsa,ssh-dss>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug3: ssh_get_authentication_socket_path: path '/tmp/ssh-ILQYkanletRg/agent.265502'
debug1: get_agent_identities: bound agent to hostkey
debug1: get_agent_identities: agent returned 1 keys
debug1: Will attempt key: laravel2025-h1 ED25519 SHA256:tTE0uTBM3XJuHP5eDi2Di4pwLS2sxxihMhtHYXv+1YM agent
debug1: Will attempt key: /var/www/my_domain/.ssh/id_rsa
debug1: Will attempt key: /var/www/my_domain/.ssh/id_ecdsa
debug1: Will attempt key: /var/www/my_domain/.ssh/id_ecdsa_sk
debug1: Will attempt key: /var/www/my_domain/.ssh/id_ed25519
debug1: Will attempt key: /var/www/my_domain/.ssh/id_ed25519_sk
debug1: Will attempt key: /var/www/my_domain/.ssh/id_xmss
debug1: Will attempt key: /var/www/my_domain/.ssh/id_dsa
debug2: pubkey_prepare: done
debug1: Offering public key: laravel2025-h1 ED25519 SHA256:tTE0uTBM3XJuHP5eDi2Di4pwLS2sxxihMhtHYXv+1YM agent
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: laravel2025-h1 ED25519 SHA256:tTE0uTBM3XJuHP5eDi2Di4pwLS2sxxihMhtHYXv+1YM agent
debug3: sign_and_send_pubkey: using publickey with ED25519 SHA256:tTE0uTBM3XJuHP5eDi2Di4pwLS2sxxihMhtHYXv+1YM
debug3: sign_and_send_pubkey: signing using ssh-ed25519 SHA256:tTE0uTBM3XJuHP5eDi2Di4pwLS2sxxihMhtHYXv+1YM
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug1: Trying private key: /var/www/my_domain/.ssh/id_rsa
debug3: no such identity: /var/www/my_domain/.ssh/id_rsa: No such file or directory
debug1: Trying private key: /var/www/my_domain/.ssh/id_ecdsa
debug3: no such identity: /var/www/my_domain/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /var/www/my_domain/.ssh/id_ecdsa_sk
debug3: no such identity: /var/www/my_domain/.ssh/id_ecdsa_sk: No such file or directory
debug1: Trying private key: /var/www/my_domain/.ssh/id_ed25519
debug3: no such identity: /var/www/my_domain/.ssh/id_ed25519: No such file or directory
debug1: Trying private key: /var/www/my_domain/.ssh/id_ed25519_sk
debug3: no such identity: /var/www/my_domain/.ssh/id_ed25519_sk: No such file or directory
debug1: Trying private key: /var/www/my_domain/.ssh/id_xmss
debug3: no such identity: /var/www/my_domain/.ssh/id_xmss: No such file or directory
debug1: Trying private key: /var/www/my_domain/.ssh/id_dsa
debug3: no such identity: /var/www/my_domain/.ssh/id_dsa: No such file or directory
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
[email protected]: Permission denied (publickey).

EDIT 2
The strange and outdated encryption methods could be a function of the extra attributes I added to my option files (HostKeyAlgorithms +ssh-rsa PubkeyAcceptedAlgorithms +ssh-rsa). Here is the output for a straight connection. But this method never mentions my key at all.

ssh -vvv [email protected]
OpenSSH_9.6p1 Ubuntu-3ubuntu13.13, OpenSSL 3.0.13 30 Jan 2024
debug1: Reading configuration data /var/www/my_domain/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/var/www/my_domain/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/var/www/my_domain/.ssh/known_hosts2'
debug2: resolving "github.com" port 22
debug3: resolve_host: lookup github.com:22
debug3: channel_clear_timeouts: clearing
debug3: ssh_connect_direct: entering
debug1: Connecting to github.com [140.82.114.4] port 22.
debug3: set_sock_tos: set socket 3 IP_TOS 0x10
debug1: Connection established.
debug1: identity file /var/www/my_domain/.ssh/id_rsa type -1
debug1: identity file /var/www/my_domain/.ssh/id_rsa-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_ecdsa type -1
debug1: identity file /var/www/my_domain/.ssh/id_ecdsa-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_ecdsa_sk type -1
debug1: identity file /var/www/my_domain/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_ed25519 type -1
debug1: identity file /var/www/my_domain/.ssh/id_ed25519-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_ed25519_sk type -1
debug1: identity file /var/www/my_domain/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_xmss type -1
debug1: identity file /var/www/my_domain/.ssh/id_xmss-cert type -1
debug1: identity file /var/www/my_domain/.ssh/id_dsa type -1
debug1: identity file /var/www/my_domain/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.13
debug1: Remote protocol version 2.0, remote software version libssh_0.9.0
debug1: compat_banner: no match: libssh_0.9.0
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to github.com:22 as 'git'
debug1: load_hostkeys: fopen /var/www/my_domain/.ssh/known_hosts: No such file or directory
debug1: load_hostkeys: fopen /var/www/my_domain/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug3: order_hostkeyalgs: no algorithms matched; accept original
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: [email protected],curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,[email protected]
debug2: host key algorithms: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa
debug2: ciphers ctos: [email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc
debug2: ciphers stoc: [email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc
debug2: MACs ctos: [email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none
debug2: compression stoc: none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: ecdh-sha2-nistp256
debug1: kex: host key algorithm: (no match)
Unable to negotiate with 140.82.114.4 port 22: no matching host key type found. Their offer: ssh-rsa

EDIT 3
here is the traceroute that was mentioned

traceroute to github.com (140.82.114.3), 30 hops max, 60 byte packets
 1  _gateway (10.168.1.1)  0.811 ms  1.186 ms  1.552 ms
 2  eg-1-1-25-3831-soag01.node.in.chicago.comcast.net (<deleted>)  2.938 ms  2.930 ms *
 3  be-101-1-ceg02.node.in.chicago.comcast.net (69.139.203.9)  2.578 ms  2.642 ms  2.563 ms
 4  * be-287-ceg01.node.in.chicago.comcast.net (162.151.92.157)  2.802 ms  2.389 ms
 5  * * *
 6  be-200-ar01.elmhurst.il.chicago.comcast.net (96.217.86.61)  4.143 ms * *
 7  * be-501-arsc1.elmhurst.il.chicago.comcast.net (96.216.150.109)  4.917 ms *
 8  * be-32241-cs24.northlake.il.ibone.comcast.net (96.110.43.29)  6.909 ms *
 9  be-2113-pe13.350ecermak.il.ibone.comcast.net (96.110.32.86)  9.101 ms * *
10  ae8.cr9-chi1.ip4.gtt.net (63.141.223.245)  4.339 ms * *
11  ae13.cr1-was1.ip4.gtt.net (213.200.115.178)  38.249 ms  38.241 ms ae12.cr1-was1.ip4.gtt.net (213.200.120.54)  38.305 ms
12  ip4.gtt.net (76.74.61.150)  22.649 ms *  22.786 ms
13  * * *
14  * * *
15  * * *
16  lb-140-82-114-3-iad.github.com (140.82.114.3)  22.855 ms  21.449 ms  23.334 ms

UPDATE
I spun up a new VM and started a fresh install of Ubuntu 22.04. It did the same thing. But I had a growing nagging question - Could my Hyper-V host be a part of this problem?!? Tonight, I copied the VM to a different host and voila...

$ ssh [email protected]  
PTY allocation request failed on channel 0
Hi github_username! You've successfully authenticated, but GitHub does not provide shell access.
Connection to github.com closed.


Any idea what on the Hyper-V host could be causing this stupidity?

Working one

Windows Server 2022 Standard on 21H2 Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz 2.10 GHz (2 processors)

Failing one

Windows Server 2022 Standard on 21H2 Intel(R) Xeon(R) Gold 6154 CPU @ 3.00GHz 2.99 GHz (2 processors)

Improve this question
4
  • Try the ssh again with -vvv and update your question. I suspect a certain problem but don't want to lead you down rabbit holes. Commented Aug 22 at 15:44
  • @mwinters updated with the -vvv output Commented Aug 26 at 3:06
  • 1
    I note that GitHub's SSH host public key RSA fingerprint is supposed to be SHA256:uNiVztksCsDhcc0u9e8BujQXVUpKZIDTMczCvj3tD2s instead of SHA256:7zYnlSpxx6z0t477lR5vNYfelxewzWwu8N1X6v+wsZA, and that it is also supposed to offer other host key algorithms (such as Ed25519, which my tests used) without having to enable RSA in the client config. Source: docs.github.com/en/authentication/… Commented Aug 26 at 4:27
  • 1
    Your EDIT 2 doesn't say anything about your user key because when not allowing hostkey ssh-rsa it fails in the initial handshake, and user authentication only starts if and after the initial handshake succeeds. Commented Aug 27 at 1:47

1 Answer 1

Reset to default
0

You're not actually connecting to GitHub. The device that you're talking to is not the real 140.82.112.3. Its RSA host key doesn't match that of GitHub, and its cipher list offer doesn't match that offered by GitHub servers. The real server is supposed to offer Curve25519 before ECDH, and ChaCha20 before AES; it is not supposed to offer 3DES at all as your does. And the real server does not claim to be 'libssh2' (GitHub seems to just send a commit hash as the software name, currently 'cb24e083').

And of course, since the workaround you found regarding 'ssh-rsa' is for outdated SSH servers – OpenSSH first implemented RSA-SHA256 in 2015 and only began disabling RSA-SHA1 in 2021 – it should be pretty strange that the site that's the forefront of modern software development would be still missing a security update literally 10 years later.

(Even more so because the GitHub servers are also supposed to offer Ed25519 and P256 host keys, so even if they still somehow hadn't fixed the RSA issue 10 years in, your client wouldn't be complaining because it'd have prioritized one of the EC key types anyway.)

So take a look at traceroute -N1 140.82.112.3 – and compare the regular output with the one you get with the --icmp option added (might need 'sudo'), and maybe more interesting would be the output with the --tcp --port=22 options added. One of those might show that the IP address might have been 'accidentally' routed to a different network by your router or by your ISP, especially so if the TCP/22 trace is different than the others.

(The fact that it accepts your user key is slightly concerning, but might just be because you are somehow connecting to one of your own machines/devices/VMs. The other option is someone running a fake server that collects user passwords...)

Improve this answer
8
  • The strange and outdated encryption ciphers could have been a function of methods I added to force connection protocols (HostKeyAlgorithms +ssh-rsa PubkeyAcceptedAlgorithms +ssh-rsa) . I added a EDIT 2 to my question with the straight output of ssh -vvv [email protected] Commented Aug 27 at 0:57
  • In addition to ISP misrouting, OP might be in an environment that (deliberately) intercepts traffic, like a business, organization, or school. Maybe even hotel or campground. Also in the -vvv log client sends userauth probe with 50 and gets 60=OK but then sends signature with 50 and gets 51=fail; this suggests either a deceptive or quite broken host. @wruckie: the host's KEXINIT is not affected by any of your options; it is only after both ends send KEXINIT that algorithm negotiation begins. Commented Aug 27 at 1:55
  • So where do I turn from here? I have knowledge of our own tech stack and don't suspect any interception. I added EDIT 3 with the traceroute Commented Aug 27 at 2:18
  • @wruckie: No they couldn't. I wasn't talking about the client-offered ciphers, but about the 2nd list several lines down – the server-offered ones. The server's offer doesn't change based on client offer (even more so because your client isn't offering 3des, for example), and I still stand by that part of my answer, as well as the rest of it. Please compare the "regular" traceroute with the --tcp --port=22 one. Post also the output of ssh -vvv -p 443 [email protected] (note ssh.github.com, not regular github.com) to compare it with the regular port-22 connection. Commented Aug 27 at 5:20
  • @wruckie: ...and if you could, also compare ssh -vvv YOUR_LAN_ROUTER_IP. If you're on a LAN with your own router, that is. It could even be that a "port forwarding" rule was made slightly too broad. Commented Aug 27 at 6:09

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.