Can't push to bitbucket, Permission denied (publickey)

Question

I am trying to push my project onto my bitbucket, been messing with this for about 4 days pouring through countless problem solving/pages/troubleshooting/tutorials. Im at a loss and very frustrated. I have done this before but on different computers...anyway here is the code/response that I'm getting

~/dev/sample_app git push -u origin --all
The authenticity of host 'bitbucket.org (131.103.20.168)' can't be established.
RSA key fingerprint is 81:7b:2c:f5:6f:18:2b:7c:4b:ec:aa:46:46:74:7c:40.
Are you sure you want to continue connecting (yes/no)? 
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
~/dev/sample_app

I am on a mac running 10.8.4.

So a little progress has been made, initially there was no .ssh folder so I created that way back in the beginning, there was no known_hosts file so I ran

ssh -T git@bitbucket.org

I chose yes and this created a known_hosts file and when I tried to push again I got:

~/dev/sample_app git push -u origin --all
Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

My .ssh folder is 700 and the keys inside are all 600.

Answering your own question as a formal answer is actually encouraged, just so you know :) — iono, Nov 29 '13 at 10:59
And the public key corresponding to your private key is registered on your bitbucket account right? — janos, Dec 24 '14 at 12:31

score 91 · Answer 1 · answered May 19 '14 at 07:15

91

You can set IdentityFile flag file in ~/.ssh/config file as follows:

Host bitbucket.org
  IdentityFile ~/.ssh/id_rsa

When you run

ssh git@bitbucket.org

the ssh client allows you to selects a file from which the identity (private key) for RSA or DSA authentication is read.

SSH Client To Use Given Private Key ( identity file )

answered May 19 '14 at 07:15

cyb0k

2,478
23
19

1

On my Linux box, it was sufficient to add a `Host bitbucket.org` stanza at the end of my `~/.ssh/config` file. But for some reason on MacOS, I had to put that stanza at the beginning of the file in order to force the `IdentityFile` directive to take precedence over the default in the `Host *` section. – MarkHu Oct 25 '19 at 18:51
For me it worked with `IdentityFile ~/.ssh/id_rsa.pub` .i.e. with using public file as identity file – Alexander Stepaniuk Aug 15 '21 at 16:56
If it was working for a repo and now it isn't. Double check the SSH key exists. My keys were zipped and encrypted in `.ssh` after a laptop migration. – doughgle Mar 09 '22 at 09:57
Also, make sure that you are logged in as the root user. Normally, git is using root user ~/.ssh/ folder keys to authenticate. So, when you are setting up keys and everything, you must do as the root user. – Kasun Sampath Weligamage Jul 05 '23 at 15:30

score 79 · Answer 2 · answered Aug 23 '17 at 01:17

79

You might be using ssh as the git origin url. Try removing the ssh origin like so

git remote rm origin

Then add new origin with HTTPS url and try pushing again.

git remote add origin https://git@bitbucket.org/SOMETHING/SOMETHING.git
git push -u origin master

Make sure you paste your url from bitbucket as origin.

answered Aug 23 '17 at 01:17

Ronny K

3,641
4
33
43

2

This is the natural solution for it, and I always forget – MehranTM Mar 17 '19 at 20:28
2

It worked - I am allowed to have access using the URL and not ssh - that why this works. if you have ssh access to other repo's in your account then use the ssh link only and not the https link – Abdeali Chandanwala Jun 14 '19 at 10:57
1

Worked, and solved the problem. – hotsing Jan 15 '22 at 02:52
2 hours spend, again... Much thanks for the answer! Bitbucket is so terrible........ – Oleg Reym Nov 01 '22 at 12:48

score 30 · Answer 3 · answered Nov 07 '16 at 13:36

30

In my case on fresh Ubuntu 16 machine I was missing files in ~/.ssh folder so what worked:

Go to folder ~/.ssh
Run ssh-keygen and name your file i.e. id_rsa
Run cat ~/.ssh/id_rsa.pub | xclip -sel clip
If you miss xclip just apt-get install xclip :)
Go to (in url change USERNAME to your bitbucket username:) ) https://bitbucket.org/account/user/USERNAME/ssh-keys/
Click Add key and paste the key from the clipboard

Magic - it works now :)

answered Nov 07 '16 at 13:36

pbaranski

22,778
19
100
117

The question is for Mac OS, apt-get has nothing to do – coto May 16 '17 at 18:35
Problem on Ubuntu lead me to this Q&A (why? see the tags) and this problem touches Ubuntu users to - so I described my experience with - well.. Ubuntu (because I cannot 100% say that this solution will work in other OS). Cheers. – pbaranski May 18 '17 at 07:22
still not working for me (i am using Mac), any idea ? – questionasker Sep 15 '17 at 10:10
2

For Windows; `C:\Users\\.ssh` (replace **** with your **user name**). Download `Git Bash` which allow `ssh-keygen` and host of other features which can be downloaded here >> https://git-scm.com/download/win. – Aakash Mar 13 '18 at 05:34
1

For Mac instead of xclip, we can use: cat ~/.ssh/id_rsa.pub | pbcopy – Baig Aug 01 '22 at 04:04

Cosmittus · Answer 4 · 2022-02-11T11:32:41.020

23

Edit: As Dan Swain points out in the comments, from 1 March 2022 this answer will have been superseded by authentication policy changes: https://bitbucket.org/blog/deprecating-atlassian-account-password-for-bitbucket-api-and-git-activity

The same applies to Github repositories as well, FWIW.

Thanks for the heads-up, Dan.

~~It might make sysadmins recoil in horror, but after suffering this problem (Windows) I gave up on SSH and went back to HTTPS.~~

When first adding the remote repository to Git, replace the SSH reference 'git@bitbucket.org...' with the HTTPS URL 'https://<username>@bitbucket.org'.

You have to type your password in every time but, particularly under Windows where SSH is not as commonly available as with the *nix family, I see this as a minor inconvenience compared with the headaches of SSH.

edited Feb 11 '22 at 11:32

answered Dec 24 '14 at 11:16

Cosmittus

637
6
19

1

I've spent hours and hours on this, and it appears that the _only_ way to get this working is by using Pageant. I don't like running software like this constantly in the background, especially if it integrates into the Windows Explorer, but it seems that BitBucket doesn't work in the same straight-forward way like GitHub, where I can simply use `ssh-keygen` to generate a public key and add it to my GitHub account. I've accepted that BitBucket and Windows is just a poor combination and have resorted to using HTTPS. – Paul Lammertsma Apr 12 '16 at 09:54
I'm working on win 10 and I had to use HTTPS instead. – Ali Afsahnoudeh Jul 27 '20 at 07:59
1

After February 2022 you can no longer use password-based authentication for BitBucket access: https://bitbucket.org/blog/deprecating-atlassian-account-password-for-bitbucket-api-and-git-activity – Dan Swain Feb 07 '22 at 16:35

score 19 · Answer 5 · answered Feb 13 '18 at 19:12

19

After setting up git with git config --global user.name "My Name" and git config --global user.email myemail@x.com, I was still having trouble with the Permission Denied, (publickey) error. To solve this, I first generated a new ssh token with

ssh-keygen

and copied it with

pbcopy < ~/.ssh/YOUR_KEY

After that, I went to bitbucket.com to add it as a new SSH key in my settings. Then, I returned to my terminal to add the new key with

ssh-add ~/.ssh/YOUR_KEY.

The big problem that I was having was that I missed the critical ssh-add [key] command.

answered Feb 13 '18 at 19:12

keala

377
3
10

worked properly for me, thanks! to clarify just a bit, in the bit bucket ui, click your account icon in the upper right, select account settings, click "ssh keys" in the left panel, click the "add key" button, a text box will show, paste your ssh key you generated with ssh-keygen into the text box and save. – StvnBrkdll May 11 '21 at 16:21
This worked like charm. In addition the . at the end of the ssh-add is a full stop, not a command. I used ssh-add ~/.ssh/YOUR_KEY Thanks – joseph chikeme Jan 10 '23 at 19:34
Works for me, thanks! `After that, I went to bitbucket.com to add it as a new SSH key in my settings` This step helped me. This step wasn't mentioned at all in the documentation I am referring to. – user3437460 Jan 17 '23 at 04:11
What you paste in bitbucket *Add key* step is the public key. But in the *ssh-add* step, you have to use the private key. (ssh-add ~/.ssh/id_rsa) – Seshadri R Jun 30 '23 at 05:23

score 16 · Answer 6 · answered Mar 22 '18 at 21:40

16

I had similar problem with BitBucket. in my case, it only fixed after I found out I should remove sudo from git clone command!

According to Attlassian:

You shouldn't use sudo when cloning, pushing, or pulling because the ssh-agent runs on the user level, not the root level.

answered Mar 22 '18 at 21:40

Iman Sedighi

7,624
4
48
55

I've wasted a lot of time cause of it, thank you. – scorpion Aug 31 '22 at 09:52

score 15 · Answer 7 · edited May 04 '22 at 06:18

15

A more sustainable solution is to edit .bashrc (e.g. vi ~/.bashrc) and then add the following line to it (replace the key name):

KEY="$HOME/.ssh/YOUR_KEY"
if [ -e "${KEY}" ]; then
  ssh-add -q "${KEY}"
fi

This will load the key automatically when you start the shell

edited May 04 '22 at 06:18

Dave Jarvis

30,436
41
178
315

answered May 15 '14 at 08:13

iTech

18,192
4
57
80

not working this way – Suraj Prajapat Aug 10 '22 at 19:06

Joyescat · Answer 8 · 2021-08-22T19:20:37.247

If you're using Fedora 33+ and using the RSA algorithm. Use more secure alogrithm like ECDSA or ED25519 instead:

ssh-keygen -t ed25519 -C "your_email@example.com"

Check out the bitbucket support for more details

Cause

The RSA algorithm is being quickly deprecated across operating systems and SSH clients because of various security vulnerabilities, with many of these technologies now outright denying the use of this algorithm.

(info) For example - here is the announcement from OpenSSH regarding their upcoming deprecation of the ssh-rsa algorithm. In the event that you are using an operating system or SSH client whose version has this algorithm disabled, it's possible that any SSH keys previously generated using this algorithm will no longer be accepted by these technologies.

Resolution

To fully resolve this issue, our team recommends that these deprecated keys be re-generated using a supported and more secure algorithm such as ECDSA and ED25519

This solved my issue. Note that Atlassian official documentation explicitly uses RSA, even though this algorithm is silently denied (https://www.atlassian.com/git/tutorials/git-ssh) — Adam, Aug 23 '21 at 16:15

score 5 · Answer 9 · edited Mar 07 '16 at 19:58

I faced same issues in Linux (Ubuntu).

I solved it using setup in git:

git config --global user.name "Your Name"
git config --global user.email your.email@example.com

Printing the public key using cat and SSH key to bitbucket.org:

$ cat ~/.ssh/id_rsa.pub

Adding Bitbucket and pushing up the repository:

git remote add origin git@bitbucket.org:<username>/your repository name.git
git push -u origin --all

That's all!

score 5 · Answer 10 · answered Jan 05 '21 at 05:07

In my case, this issue happened because I had a number of ssh keys in the ~/.ssh. I had to create a bitbucket.org specific entry in ~/.ssh/config as follows:

Host bitbucket.org
    Hostname bitbucket.org
    IdentityFile <location-of-.ssh-directory>/bb-rsa
    IdentitiesOnly=yes

My guess is that since we don't specify a key while cloning, ssh tries all the keys in ~/.ssh which bitbucket thinks as a hacking attempt and rejects our repo clone attempt.

score 3 · Answer 11 · answered Oct 17 '15 at 20:42

In my case it solved the problem to add the ssh key from the directory

~/.ssh/id_rsa.pub

on bitbucket.org. I named it also id_rsa.pub on the website.

At the beginning I added another key I created just for bitbucket and named it like that. The first remote actions worked but after some days the request have been denied.

score 2 · Answer 12 · answered Sep 24 '16 at 23:39

2

Check for exisiting SSH Key

ls -al ~/.ssh

Copy the SSH Key

cat ~/.ssh/id_rsa.pub | pbcopy

Add the copied SSH Key to 'Bitbucket Settings', 'Security', 'SSH Keys'.

answered Sep 24 '16 at 23:39

Michael

591
8
24

Anjum.... · Answer 13 · 2020-11-28T09:56:46.067

If you have multiple keys in your computer make sure you add bitbucket to the list such as below in

.ssh/config

# Company account
Host company
HostName github.com
PreferredAuthentications publickey
IdentityFile ~/.ssh/id_rsa_accelya

# Personal account
Host personal
HostName github.com
PreferredAuthentications publickey
IdentityFile ~/.ssh/id_rsa_personal


# Personal account bitbucket
Host bitbucket
HostName bitbucket.org
PreferredAuthentications publickey
IdentityFile ~/.ssh/id_rsa_personal_bitbucket

score 2 · Answer 14 · answered Jul 05 '22 at 08:39

2

My Solution:

git remote rm origin

Add you user name before @bitbucket.org to the repo URL

git remote add origin https://{USER_NAME}@bitbucket.org/{NAME}/{REPO_NAME}.git

git push -u origin master

answered Jul 05 '22 at 08:39

Shay Elbaz

39
3

I'm not sure this works anymore as I believe bitbucket only allows pushing via SSH now. Can anyone confirm? – Kyle Jun 18 '23 at 06:03

score 1 · Answer 15 · answered Nov 03 '17 at 02:06

This may be obvious, but I spent quite a bit of time on it.

Check the destination when running git remote -v

In my case I had the ssh keys perfectly set up but the output from this command was:

origin get@github.com:USERNAME/REPOSITORY.git

(notice the get not git)

and not

origin git@github.com:USERNAME/REPOSITORY.git

Again, this was a very particular case, but be sure to check the strings carefully of this system if you're having trouble.

You can fix this with the following commands:

git remote set-url origin git@github.com:USERNAME/REPOSITORY.git

score 1 · Answer 16 · answered Feb 16 '18 at 15:22

Make sure your have switched to the correct user on terminal.

In my case root user was not the one which has ssh keys added at the bitbucket settings panel. Running git with sudo makes it run from root user and my own user was the one who has keys added.

score 1 · Answer 17 · answered Mar 13 '18 at 13:40

My problem was to do with permissions.

My project directory was owned by root, but I was logged in as ubuntu. I would get PERMISSION DENIED if I typed in a git command, e.g. git pull origin master, so I used sudo git pull origin master.

I had registered ubuntu's SSH key from /home/ubuntu/.ssh/id_rsa.pub with BitBucket.

However, I was using sudo. So the SSH key used was actually /home/root/.ssh/id_rsa.pub which was different to what BitBucket had.

Solution for my case

chown -R username_here:username_here project/folder/here

Now it should work if you don't prepend sudo

OR give BitBucket root's key

score 1 · Answer 18 · answered Nov 29 '19 at 09:02

In my case my issue was that I tried using the .ppk file the putty generated and no matter what I tried nothing worked.

In the end I figured that the it was the wrong file and I had to export it, save it as the id_rsa file and load it, then everything worked.

score 1 · Answer 19 · answered Feb 20 '20 at 06:00

If any.ssh fix didn't work or you cloned as https there can be a validation issue. in my case, I fixed this error by providing my username and password when cloning the repo. This issue can occur when you are using multiple accounts in a same machine.

use "git clone https://username:password@github.com/username/repository.git" command with your user name and password and repo URL.

score 1 · Answer 20 · answered Apr 08 '20 at 20:35

I like the Answers here, but they all kind of miss a possible root cause.

with the command:

ssh -T git@bitbucket.org

replace bitbucket.org with your own bitbucket host.

If you get an answer like:

This deploy key has read access to the following repositories:

team-name/repository-name

that is why pushing to the repository is not working.

This you can also double check in the Bitbucket Web UI, notice the read-only access in the description:

Hope this gives a different perspective to the same problem.

so what you need to do to get write access? – Krishnadas PC Jun 24 '20 at 05:19 — Krishnadas PC, Jun 24 '20 at 05:19

score 1 · Answer 21 · answered Nov 22 '21 at 00:32

1

I update config file with the top line to get it working

PubkeyAcceptedKeyTypes +ssh-rsa

Host <yourhost>

IdentityFile ~/.ssh/id_rsa

answered Nov 22 '21 at 00:32

Jay

133
2
12

score 0 · Answer 22 · answered Jan 12 '16 at 12:35

In Windows, @efesaid answer worked for solving issues with the ssh connection test. By the way, you can add a -v to see what keys (by name) are being attempted and why the connection fails.

However, when pushing to bitbucket, using git@bitbucket.org:user/repo.git, it seems that the host is not precisely bitbucket.org so I still was getting permission denied problems. I solved them by (re)naming my key to id_rsa (this is the key name that was being attempted in the ssh test).

This works if you have a single rsa key. For multiple keys, perhaps the host in the config file must be

bitbucket.org:username

but I am no sure this is unde

score 0 · Answer 23 · answered Jun 29 '16 at 11:57

I think that the bitbucket instructions are best. Check if ssh is installed and if not install it

krasen@krasen-Lenovo-Y50-70:~$ ssh -v
usage: ssh [-1246AaCfgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]
           [-D [bind_address:]port] [-E log_file] [-e escape_char]
           [-F configfile] [-I xxxxx] [-i identity_file]
           [-L [bind_address:]port:host:hostport] [-l login_name] [-m mac_spec]
           [-O ctl_cmd] [-o option] [-p port]
           [-Q cipher | cipher-auth | mac | kex | key]
           [-R [bind_address:]port:host:hostport] [-S ctl_path] [-W host:port]
           [-w local_tun[:remote_tun]] [user@]hostname [command]

krasen@krasen-Lenovo-Y50-70:~$ ls -a ~/.ssh 
.  ..  google_compute_engine  google_compute_engine.pub  identity  identity.pub  known_hosts

krasen@krasen-Lenovo-Y50-70:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/krasen/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/krasen/.ssh/id_rsa.
Your public key has been saved in /home/krasen/.ssh/id_rsa.pub.
The key fingerprint is:
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx krasen@krasen-Lenovo-Y50-70
The key's randomart image is:
+--[ RSA 2048]----+
|              .  |
|           xx x  |
|          xxxxx  |
|       xxxxxxxxx |
|      .xxxxxxxx  |
|       xxxxx     |
|     xxxxxxxxxxxx|
|    xxxxxxxxxxxxx|
|     xxxxxxxxxxx |
+-----------------+                                                                                                                                  
krasen@krasen-Lenovo-Y50-70:~$ ls -la ~/.ssh                                                                                                         
total 40
drwx------   2 krasen krasen 4096 Jun 29 14:30 .
drwxr-xr-x 110 krasen krasen 4096 Jun 29 13:00 ..
-rw-------   1 krasen krasen 1675 Mar 18  2015 google_compute_engine
-rw-r--r--   1 krasen krasen  409 Mar 18  2015 google_compute_engine.pub
-rw-------   1 krasen krasen 1679 Jun 29 13:15 identity
-rw-r--r--   1 krasen krasen  409 Jun 29 13:15 identity.pub
-rw-------   1 krasen krasen 1679 Jun 29 14:30 id_rsa
-rw-r--r--   1 krasen krasen  409 Jun 29 14:30 id_rsa.pub
-rw-r--r--   1 krasen krasen 4698 Jun 29 13:16 known_hosts

krasen@krasen-Lenovo-Y50-70:~$ ssh-agent /bin/bash

to check if the agent is started

krasen@krasen-Lenovo-Y50-70:~$ ps -e | grep [s]sh-agent 
26503 ?        00:00:00 ssh-agent
krasen@krasen-Lenovo-Y50-70:~$ ssh-add ~/.ssh/id_rsa
Identity added: /home/krasen/.ssh/id_rsa (/home/krasen/.ssh/id_rsa)
krasen@krasen-Lenovo-Y50-70:~$ ssh-add -l 
2048 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx /home/krasen/.ssh/id_rsa (RSA)
krasen@krasen-Lenovo-Y50-70:~$ cat ~/.ssh/id_rsa.pub
ssh-rsa xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

get this key and add it as key in the bitbucket settings

score 0 · Answer 24 · answered Sep 28 '17 at 12:53

0

I got round a similar issue where I had previously used HTTPS to access the repository and had to switch to SSH by setting the url like so;

git remote set-url origin ssh://git@bitbucket.org/...

answered Sep 28 '17 at 12:53

McEwin

1
1

score 0 · Answer 25 · answered Feb 20 '20 at 05:48

0

In source tree select your project right click then you find an option "Convert to SSH"-> Repair -> login this solved for me

answered Feb 20 '20 at 05:48

Sajin

9

score 0 · Answer 26 · answered Jul 14 '20 at 17:34

If you are using SourceTree with Bitbucket, the solution is the next:

Go to your personal Bitbucket settings Got to App passwords and create an app password Give the next permissions to the app password:

Repositories (R-W-A-D)
Projects (R-W)
Pull request (R-W)

After that, keep the password generated Try to clone again your repo A password popup will be displayed, input the generated password. That's all.

Chris Halcrow · Answer 27 · 2023-07-12T00:27:12.123

Steps to diagnose/troubleshoot:

Verify that you have a private and public key generated and located under ~/.ssh (tip - use consistent naming that matches key names to the name of the remote, avoid generic names for the private key like id_rsa, there are lots of those in the world ...).
If you don't have valid keys generate/regenerate them:
- cd ~/.ssh
- ssh-keygen -t ed25519 -b 4096 -C myusername@emaildomain.com -f my_ssh_key.
This gives you a public key my_ssh_key.pub and a private one my_ssh_key
Ensure the private key is read/writable only to you - chmod 600 ~/.ssh/my_ssh_key (it's the one without the .pub suffix)
Check if you can connect to the remote using ssh -T git@mybitbucketrepo.com
If connection doesn't succeed, run verbose connection attempt using ssh --t -vvv git@mybitbucketrepo.com (look for errors toward end of output indicating failure reason)
Check if the agent knows about your private ssh key by getting a list of added keys ssh-add -l. If not add it - ssh-add ~/.ssh/my_ssh_key (tip - on Mac add it to the keychain using ssh-add -k ~/.ssh/my_ssh_key)
View your config to ensure that your private ssh key is registered by an IdentityFile entry in your ~/.ssh config file - cat ~/.ssh/config, and there is an entry AddKeysToAgent yes
Check if any malformed or invalid errors with the config are being reported
Ensure your public key is added as an SSH key in Bitbucket under settings > Personal Settings > SSH keys(tip - use an identical name that matches your key names, for easier identification). To get the text to add as the public key, use cat ~/.ssh/my_ssh_key.pub (tip - on Mac pipe direct to clipboard using cat ~/.shh/my_ssh_key.pub | pbcopy, to ensure correct line ending is captured)

score 0 · Answer 28 · answered Jul 18 '23 at 20:00

If you are using mac,

open terminal & go the home "cd ~"

run "ssh-keygen" & you will see

Generating public/private rsa key pair.
Enter file in which to save the key (/Users/<abc>/.ssh/id_rsa):

Press Enter, it will show this

Enter passphrase (empty for no passphrase):
Enter same passphrase again:

Press Enter again
And you will see your id_rsa & id_rsa.pub in "/Users/< abc>/.ssh"
Open id_rsa.pub & copy the whole thing paste it under Personnel Settings->SSK keys-> Add Key

Can't push to bitbucket, Permission denied (publickey)

28 Answers28

to check if the agent is started

Linked