0

SHORT

Why is git pull/push not working now that ssh behind firewall is functioning (esp. ssh git@bitbucket.org).

Similar questions has been asked, and I have read them. But I still have a lack of understanding.

I'm sitting behind a corporate firewall and I managed to set up a ssh connection (port 443) to my router (DD-Wrt @ Asus RT-N16, sshserver is dropbear) via configuring ~/.ssh/config (with corkscrew + company http proxy).

Since port 22 is blocked, I thought I could set up a ssh tunnel, that enables me to use port 22 for further ssh commands from my workmachine, especially for use with git push/pull (using bitbucket, which doesn't support ssh access via port 443...)

I'd be happy for some input. Or maybe even other approaches.

I'm just noticing...git uses it's own ssh command (in $GIT_SSH), which I didn't consider. But that would be just a small part of the problem since even ssh git@bitbucket.org didn't work.

SCENARIO

workmachine --> firewall --> asus_rtn16 --> git repo

EDIT

The forwarding is working now, I can ssh into every machine. Git is still having some trouble.

~/.ssh/config

Host asus
        HostName myrouter.com
        User admin
        Port 443
        ProxyCommand C:/cygwin/bin/corkscrew.exe companyproxy proxy_port %h %p
        IdentityFile C:/cygwin/home/*user*/.ssh/id_rsa
Host *
        ProxyCommand ssh asus nc -w1 %h %p
        IdentityFile C:/cygwin/home/*user*/.ssh/id_rsa

I'm not prompted for login. I added RSA authentification, but I'm also not prompted for the password protecting the key.

I did set GIT_SSH to point to the right ssh, and the paths in the config are absolute.

This happens when I try to push

$ git push --verbose -u origin --all
Pushing to ssh://git@bitbucket.org/*username*/myrepo.git
OpenSSH_4.6p1, OpenSSL 0.9.8e 23 Feb 2007
debug1: Reading configuration data /c/cygwin/home/*user*/.ssh/config
debug1: Applying options for asus
debug1: Applying options for *
debug1: Executing proxy command: exec C:/cygwin/bin/corkscrew.exe *proxy* *port* *router* 443
debug1: permanently_drop_suid: 500
debug1: identity file /c/cygwin/home/<user>/.ssh/id_rsa type 1
debug1: identity file /c/cygwin/home/<user>/.ssh/id_rsa type 1
debug1: Remote protocol version 2.0, remote software version dropbear_0.52
debug1: no match: dropbear_0.52
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_4.6
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: sending SSH2_MSG_KEXDH_INIT
debug1: expecting SSH2_MSG_KEXDH_REPLY
debug1: Host '[*router*]:443' is known and matches the RSA host key.
debug1: Found key in /c/cygwin/home/*user*/.ssh/known_hosts:2
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
DD-WRT v24-sp2 big (c) 2011 NewMedia-NET GmbH
Release: 02/17/11 (SVN revision: 16214)
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: /c/cygwin/home/*user*/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: PEM_read_PrivateKey failed
debug1: read PEM private key done: type <unknown>    # freezes here...

fatal: Could not read from remote repository.        # continues after ctrl + c

Please make sure you have the correct access rights
and the repository exists.

A normal ssh connection should continue like

Enter passphrase for key '/home/*user*/.ssh/id_rsa': 
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
Authenticated to *router* (via proxy).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: Sending command: nc -w1 sdf-eu.org 22

DEBUG LV3

git push -u origin --all is failing

debug1: Next authentication method: publickey
debug1: Offering public key: C:/cygwin/home/*user*/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp 31:cc:3b:fa:xx:xx:xx:a1:ae:d6:21:97:62:68:fa:f0
debug3: sign_and_send_pubkey
debug1: PEM_read_PrivateKey failed
debug1: read PEM private key done: type <unknown>

ssh -vvv asus is succeeding

debug1: Next authentication method: publickey
debug1: Offering RSA public key: C:/cygwin/home/*user*/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp 31:cc:3b:fa:xx:xx:xx:a1:ae:d6:21:97:62:68:fa:f0
debug3: sign_and_send_pubkey: RSA 31:cc:3b:fa:xx:xx:xx:a1:ae:d6:21:97:62:68:fa:f0
debug1: Authentication succeeded (publickey).
Authenticated to *router* (via proxy).

There seems to be something wrong with debug3: sign_and_send_pubkey.

Additional data

chmod of ~/ is 755, chmod of id_rsa.pub is 644 and id_rsa has 600

jim810
  • 128
  • 2
  • 10

1 Answers1

2

Disclaimer: If this kind of connection is allowed ask your security people to enable it for you. If it is not allowed and you nevertheless use some tunneling to circumvent the security concept of your company you will get a lot of trouble! Be warned.

You already managed to get to your router. In this case I would use

ProxyCommand ssh router nc -w1 %h %p

in your .ssh/config.

This will first open a ssh connection to you router and connect to the actual target host and then start the actual ssh connection. Also git should work with this kind of setup.

michas
  • 25,361
  • 15
  • 76
  • 121
  • Thanks for the warning and the help so far. I'll try it asap. Could you please elaborate on that. For instance what exactly is `-w1` I found nothing about it. – jim810 Jun 04 '13 at 22:30
  • Oh, did't know about `man ssh_config`. And why you did you choose this approach instead of maybe `ssh -L`? – jim810 Jun 04 '13 at 22:56
  • 1
    `ssh -L` will just open a single local socket, which you have to explicitly use specifying `localhost`. - This should work but requires two manual steps, while the above solution is completely transparent. `ssh -D` is another option. In this case you have to configure your application to use the local socks proxy. – michas Jun 05 '13 at 07:13
  • To mention: I checked with the IT department. They told me it's okay...but they still won't open the port for me :) Furthermore, I managed to ssh into abritray servers even `git@bitbucket.org`, but git push/pull command still is not working, both with the erros I added to the question – jim810 Jun 05 '13 at 16:01
  • could you please help me with - http://stackoverflow.com/questions/21600830/ssh-ing-to-remote-server-from-behind-a-proxy – whatf Feb 06 '14 at 11:07