Public key authentication fails in Pipeline deployment script

Question

Hello all there, I use the following bitbucket-pipelines.yml in my repository: _____________________________ pipelines:branches:master:- step:name: Deploy to dropletdeployment: Productionscript:- echo $USER- echo $SERVER- echo "Deploying master to live"- ssh -v -t bitbucket@xxx.xxx.xxx.xxx- echo "Deploy step finished"_____________________________and I get the following error:ssh_askpass: exec(/usr/bin/ssh-askpass): No such file or directoryPermission denied, please try again.The complete debug is as follows:______________________________+ ssh -v -t bitbucket@xxx.xxx.xxx.xxxOpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014debug1: Reading configuration data /root/.ssh/configdebug1: Reading configuration data /etc/ssh/ssh_configdebug1: /etc/ssh/ssh_config line 19: Applying options for *Pseudo-terminal will not be allocated because stdin is not a terminal.debug1: Connecting to xxx.xxx.xxx.xxx [xxx.xxx.xxx.xxx] port 22.debug1: Connection established.debug1: permanently_set_uid: 0/0debug1: identity file /opt/atlassian/pipelines/agent/ssh/id_rsa type -1debug1: identity file /opt/atlassian/pipelines/agent/ssh/id_rsa-cert type -1debug1: Enabling compatibility mode for protocol 2.0debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8debug1: Remote protocol version 2.0, remote software version OpenSSH_8.9p1 Ubuntu-3ubuntu0.11debug1: match: OpenSSH_8.9p1 Ubuntu-3ubuntu0.11 pat OpenSSH* compat 0x04000000debug1: SSH2_MSG_KEXINIT sentdebug1: SSH2_MSG_KEXINIT receiveddebug1: kex: server->client aes128-ctr hmac-sha1-etm@openssh.com nonedebug1: kex: client->server aes128-ctr hmac-sha1-etm@openssh.com nonedebug1: sending SSH2_MSG_KEX_ECDH_INITdebug1: expecting SSH2_MSG_KEX_ECDH_REPLYdebug1: Server host key: ED25519 5d:25:68:08:24:72:41:1b:a2:02:c3:47:67:f0:c3:84debug1: Host 'xxx.xxx.xxx.xxx' is known and matches the ED25519 host key.debug1: Found key in /root/.ssh/known_hosts:7debug1: ssh_ed25519_verify: signature correctdebug1: SSH2_MSG_NEWKEYS sentdebug1: expecting SSH2_MSG_NEWKEYSdebug1: SSH2_MSG_NEWKEYS receiveddebug1: SSH2_MSG_SERVICE_REQUEST sentdebug1: SSH2_MSG_SERVICE_ACCEPT receiveddebug1: Authentications that can continue: publickey,passworddebug1: Next authentication method: publickeydebug1: Trying private key: /opt/atlassian/pipelines/agent/ssh/id_rsadebug1: key_parse_private2: missing begin markerdebug1: read PEM private key done: type RSAdebug1: Authentications that can continue: publickey,passworddebug1: Next authentication method: passworddebug1: read_passphrase: can't open /dev/tty: No such device or addressdebug1: permanently_drop_suid: 0ssh_askpass: exec(/usr/bin/ssh-askpass): No such file or directorydebug1: Authentications that can continue: publickey,passwordPermission denied, please try again.debug1: read_passphrase: can't open /dev/tty: No such device or addressdebug1: permanently_drop_suid: 0ssh_askpass: exec(/usr/bin/ssh-askpass): No such file or directorydebug1: Authentications that can continue: publickey,passwordPermission denied, please try again.debug1: read_passphrase: can't open /dev/tty: No such device or addressdebug1: permanently_drop_suid: 0ssh_askpass: exec(/usr/bin/ssh-askpass): No such file or directorydebug1: Authentications that can continue: publickey,passworddebug1: No more authentication methods to try.Permission denied (publickey,password).______________________________How can I resolve this issue?Regards,

Okhtay Sattari · Answer

Ben,

I changed the bitbucket-pipelines.yml as follows:

But when I go to the pipelines section of that repository to see the results, I see a stuck pipeline that is similar to an infinite loop because it does not finish at all!

My timezone is Istanbul/Turkey meanwhile.

Regards,

Ben · Answer

Hi Okhtay,

Can you instead add this to your script in your Pipelines YML?

ssh-keygen -R 207.154.231.171 >> ~/.ssh/known_hosts

If this does not resolve, please let me know which timezone you're in so I can raise a support ticket on your behalf.

Cheers!

- Ben (Bitbucket Cloud Support)

Okhtay Sattari · Answer

Hi Ben

Thank you for your reply.

I have created a public/private key, and then added the IP address of my digitalocean droplet to the known hosts section of that page to get the host's finger print. Then I coppied this bitbucket public key to ~/.ssh/authorized_keys on my droplet host. On my droplet host, I have created a special user for this purpose with the name "bitbucket" and have started a ssh agent for this user. So, the aforementioned bitbucket public key has been added to  the ~/.ssh/authorized_keys of this droplet user. I have previously added bitbucket.org to the known hosts of "bitbucket" droplet user on my droplet host, but I did it again using the command you gave:

ssh-keygen -R bitbucket.org && curl https://bitbucket.org/site/ssh >> ~/.ssh/known_hosts

. However, there is no change, and I still get the previous error:

The interesting point is that I can connect to my droplet host on my PC using the simple command: ssh bitbucket@xxx.xxx.xxx.xxx, and I have successfully configured my PC and the droplet host for this purpose, but I can not do the same thing for bitbucket.org to run a simple pipeline.