Can't connect with SSH

Hello,

So I’ve been trying to login to my server with SSH to deploy my app but it keeps not working and I’m all out of idea.

What I’ve done so far :

  1. Generating key pair on my server
  2. Adding the private key in CircleCI settings
  3. Adding the add_ssh_keys to my config.yml
  4. Added ssh-keyscan command to avoid the unknow host prompt

Here is my job :

version: 2.1

defaults: &defaults
    working_directory: ~/directory
    docker:
        - image: circleci/php:7.4-node
        - image: circleci/mysql:8.0.4
          environment:
              - MYSQL_ALLOW_EMPTY_PASSWORD=true
              - MYSQL_HOST=127.0.0.1
              - MYSQL_DATABASE=database
              - MYSQL_USER=user
              - MYSQL_PASSWORD=azerty
              - MYSQL_ROOT_PASSWORD=azerty

commands:
    test_command:
        steps:
            - checkout
            - run:
                  name: Test SSH
                  command: |
                    ssh-keyscan -p 502 $HOST >> ~/.ssh/known_hosts
                    ssh -vv user@server.com -p 502 'pwd && exit'

jobs:
    test_job:
        <<: *defaults
        steps:
            - add_ssh_keys:
                fingerprint:
                    - "c9:23:91:68:e5:89:8f:9c:36:ce:1c:b7:55:9e:91:ea"
            - test_command

workflows:
    version: 2
    test:
        jobs:
            - test_job

The ssh-keyscan command seems to be working, but I still cannot connect with SSH.
Here are the job logs :

# ****************:502 SSH-2.0-OpenSSH_7.4
# ****************:502 SSH-2.0-OpenSSH_7.4
# ****************:502 SSH-2.0-OpenSSH_7.4
OpenSSH_7.9p1 Debian-10+deb10u2, OpenSSL 1.1.1d  10 Sep 2019
debug1: Reading configuration data /home/circleci/.ssh/config
debug1: /home/circleci/.ssh/config line 2: Applying options for ****************
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "****************" port 502
debug2: ssh_connect_direct
debug1: Connecting to **************** [**************] port 502.
debug1: Connection established.
debug1: identity file /home/circleci/.ssh/id_rsa_c9239168e5898f9c36ce1cb7559e91ea type -1
debug1: identity file /home/circleci/.ssh/id_rsa_c9239168e5898f9c36ce1cb7559e91ea-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u2
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to ****************:502 as 'user'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:YXF4GqbwcyMgL7UYpWcfKANQ+ISYbYvJSM4eC3boiQs
debug1: Host '[****************]:502' is known and matches the ECDSA host key.
debug1: Found key in /home/circleci/.ssh/known_hosts:5
Warning: Permanently added the ECDSA host key for IP address '[**************]:502' to the list of known hosts.
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug1: Will attempt key: /home/circleci/.ssh/id_rsa_c9239168e5898f9c36ce1cb7559e91ea  explicit
debug2: pubkey_prepare: done
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug2: we did not send a packet, disable method
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_3434)


debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_3434)


debug2: we did not send a packet, disable method
debug1: Next authentication method: publickey
debug1: Trying private key: /home/circleci/.ssh/id_rsa_c9239168e5898f9c36ce1cb7559e91ea
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug1: Next authentication method: password
user@****************'s password: 

Too long with no output (exceeded 10m0s): context deadline exceeded

Would appreciate any help.

Thanks!

1 Like

Hi @jeanclaude! Welcome to the community!

Did you authorize the key (and for this specific user)? You can check in ~/.ssh/authorized_keys on the server for your key.

Hello @thekatertot,

Thanks for the reply.

I’m not sure I understand. Am I supposed to add the server public key to its own authorized_keys file ?
Or are you talking about another key ?

I was thinking of this section of the docs: https://circleci.com/docs/2.0/ssh-access-jobs/#ensure-authenticating-as-the-correct-user