MacOS: git@bitbucket.org: Permission denied (publickey)

[Vitalii Bendyna]

Hello, dear community!

I'm very confused with situation that unexpectedly happened. 2 days ago I was able to pull/clone/push everything fromBitBucked cloud, but today I can't do it. I spent over 5 hours googling to find the resolution but without any positive result. 

What I'm trying to do:

git clone git@bitbucket.org:somecompany/somerepo.git

Cloning into 'somerepo'...

git@bitbucket.org: Permission denied (publickey).

fatal: Could not read from remote repository.

Please make sure you have the correct access rights

and the repository exists.

What I tried to do:

1. Re-generated public/private key-pair (ssh-keygen -t RSA) and added public key to my profile in BitBucket (Icon with me -> BitBucket settings -> SSH Keys). Also, tried to set correct file permissions (400 to private and 644 to public).

2. Made sure that this key pair work on laptop of my colleague and he is able to clone the repo (he's in the same office)

3. Tried almost every step that were described on Bitbucket Community. Without results.

3. Spin up a virtual machine with Ubuntu and tried use my current key pair - no result. Tried to re-generate keys on Ubuntu and use them - the same error.

4. Enabling / disabling MacOS firewall doesn't make any influence on behaviour. I'm receiving Permission denied (publickey).

5. Tried adding my SSH key to the ssh-agent from here

Here's an output of ssh -Tv git@bitbucket.org:

ssh -Tv git@bitbucket.org

OpenSSH_7.9p1, LibreSSL 2.7.3

debug1: Reading configuration data /Users/user/.ssh/config

debug1: /Users/user/.ssh/config line 1: Applying options for bitbucket.org

debug1: Reading configuration data /etc/ssh/ssh_config

debug1: /etc/ssh/ssh_config line 48: Applying options for *

debug1: Connecting to bitbucket.org [18.205.93.0] port 22.

debug1: Connection established.

debug1: identity file /Users/user/.ssh/id_rsa type 0

debug1: identity file /Users/user/.ssh/id_rsa-cert type -1

debug1: Local version string SSH-2.0-OpenSSH_7.9

debug1: Remote protocol version 2.0, remote software version OpenSSH_7.6p1 Ubuntu-4ubuntu0.3

debug1: match: OpenSSH_7.6p1 Ubuntu-4ubuntu0.3 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002

debug1: Authenticating to bitbucket.org:22 as 'git'

debug1: SSH2_MSG_KEXINIT sent

debug1: SSH2_MSG_KEXINIT received

debug1: kex: algorithm: curve25519-sha256

debug1: kex: host key algorithm: ecdsa-sha2-nistp256

debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none

debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none

debug1: expecting SSH2_MSG_KEX_ECDH_REPLY

debug1: Server host key: ecdsa-sha2-nistp256 SHA256:Z5eiWXpMYXcM2ZAd1LTcvrTCmsNT7o5WvhcEm0p3xp4

debug1: Host 'bitbucket.org' is known and matches the ECDSA host key.

debug1: Found key in /Users/user/.ssh/known_hosts:1

debug1: rekey after 134217728 blocks

debug1: SSH2_MSG_NEWKEYS sent

debug1: expecting SSH2_MSG_NEWKEYS

debug1: SSH2_MSG_NEWKEYS received

debug1: rekey after 134217728 blocks

debug1: Will attempt key: /Users/user/.ssh/id_rsa RSA SHA256:Rb9B9b5z42Flpjj13OQMj1Lebs5iq13dPEa17MsDz6w explicit agent

debug1: SSH2_MSG_EXT_INFO received

debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>

debug1: SSH2_MSG_SERVICE_ACCEPT received

debug1: Authentications that can continue: publickey

debug1: Next authentication method: publickey

debug1: Offering public key: /Users/user/.ssh/id_rsa RSA SHA256:Rb9B9b5z42Flpjj13OQMj1Lebs5iq13dPEa17MsDz6w explicit agent

debug1: Authentications that can continue: publickey

debug1: No more authentication methods to try.

git@bitbucket.org: Permission denied (publickey).

My .ssh/config file:

Host bitbucket.org

  Hostname bitbucket.org

  User git

  PreferredAuthentications publickey

  IdentityFile ~/.ssh/id_rsa

  UseKeychain yes

  AddKeysToAgent yes

I will be very thankful if anyone can help me with resolution

[Daniil Penkin · Accepted solution]

Hello @Vitalii Bendyna,

Welcome to the Community!

debug1: Server host key: ecdsa-sha2-nistp256 SHA256:Z5eiWXpMYXcM2ZAd1LTcvrTCmsNT7o5WvhcEm0p3xp4

That's not Bitbucket's host key. Do you have any proxies / firewalls?

The correct SHA256 fingerprint is zzXQOXSRBEiUtuE8AikJYKwbHaxvSc0ojez9YXaGp1A, you can confirm this here.

Hope this helps.

Cheers,
Daniil

[Vitalii Bendyna]

Hello, @Daniil Penkin !

Thanks for your answer, it was really helpful. You're right, I've just tried to check fingerprint via another wifi network and it was correct. Seems that we have some kind of a proxy on our network equipment or there is MITM attack.

Thanks!

[jredmond]

Also worth pointing out that Bitbucket SSH doesn't offer `OpenSSH_7.6p1 Ubuntu-4ubuntu0.3` as the remote version. You should also remove that ECDSA host key from your known_hosts file, as it is incorrect. (`ssh-keygen -R bitbucket.org` should take care of that.)

Can you get anything from `ssh -Tvp443 git@altssh.bitbucket.org` ?