Capistrano rails app deploying fails. Server can't identificate self to Github. Permission denied (publickey)

Question

I am trying to deploy my rails app to the server using Capistrano.

In my local, I ran 'cap production deploy' then I got errors.

    12: from /Users/rainbowtape/.rvm/gems/ruby-2.6.5/gems/sshkit-1.20.0/lib/sshkit/backends/abstract.rb:31:in `run'
    11: from /Users/rainbowtape/.rvm/gems/ruby-2.6.5/gems/sshkit-1.20.0/lib/sshkit/backends/abstract.rb:31:in `instance_exec'
    10: from /Users/rainbowtape/.rvm/gems/ruby-2.6.5/gems/capistrano-3.11.2/lib/capistrano/scm/tasks/git.rake:18:in `block (3 levels) in eval_rakefile'
     9: from /Users/rainbowtape/.rvm/gems/ruby-2.6.5/gems/sshkit-1.20.0/lib/sshkit/backends/abstract.rb:100:in `with'
     8: from /Users/rainbowtape/.rvm/gems/ruby-2.6.5/gems/capistrano-3.11.2/lib/capistrano/scm/tasks/git.rake:19:in `block (4 levels) in eval_rakefile'
     7: from /Users/rainbowtape/.rvm/gems/ruby-2.6.5/gems/capistrano-3.11.2/lib/capistrano/scm/git.rb:38:in `check_repo_is_reachable'
     6: from /Users/rainbowtape/.rvm/gems/ruby-2.6.5/gems/capistrano-3.11.2/lib/capistrano/scm/git.rb:77:in `git'
     5: from /Users/rainbowtape/.rvm/gems/ruby-2.6.5/gems/sshkit-1.20.0/lib/sshkit/backends/abstract.rb:80:in `execute'
     4: from /Users/rainbowtape/.rvm/gems/ruby-2.6.5/gems/sshkit-1.20.0/lib/sshkit/backends/abstract.rb:148:in `create_command_and_execute'
     3: from /Users/rainbowtape/.rvm/gems/ruby-2.6.5/gems/sshkit-1.20.0/lib/sshkit/backends/abstract.rb:148:in `tap'
     2: from /Users/rainbowtape/.rvm/gems/ruby-2.6.5/gems/sshkit-1.20.0/lib/sshkit/backends/abstract.rb:148:in `block in create_command_and_execute'
     1: from /Users/rainbowtape/.rvm/gems/ruby-2.6.5/gems/sshkit-1.20.0/lib/sshkit/backends/netssh.rb:170:in `execute_command'
/Users/-------------/.rvm/gems/ruby-2.6.5/gems/sshkit-1.20.0/lib/sshkit/command.rb:97:in `exit_status=': git exit status: 128 (SSHKit::Command::Failed)
git stdout: Nothing written
git stderr: git@github.com: Permission denied (publickey).

So I went to check to server side if server can communicate with Github. It tuned out it didn't.

deploy@xx.xx.xx.xx:~$ ssh -vT git@github.com
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: /etc/ssh/ssh_config line 52: Deprecated option "useroaming"
debug1: Connecting to github.com [140.82.118.4] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/deploy/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/deploy/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/deploy/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/deploy/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/deploy/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/deploy/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/deploy/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/deploy/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: Remote protocol version 2.0, remote software version babeld-2e9d163d
debug1: no match: babeld-2e9d163d
debug1: Authenticating to github.com:22 as 'git'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: rsa-sha2-512
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ssh-rsa SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8
debug1: Host 'github.com' is known and matches the RSA host key.
debug1: Found key in /home/deploy/.ssh/known_hosts:1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,rsa-sha2-512,rsa-sha2-256,ssh-dss>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/deploy/.ssh/id_rsa
debug1: Trying private key: /home/deploy/.ssh/id_dsa
debug1: Trying private key: /home/deploy/.ssh/id_ecdsa
debug1: Trying private key: /home/deploy/.ssh/id_ed25519
debug1: No more authentication methods to try.
git@github.com: Permission denied (publickey).

Note that I already copied my local - public key to server using 'ssh-copy-id'

deploy@xx.xx.xx.xx:~/.ssh$ ls -la
total 16
drwx------  2 deploy deploy 4096 Nov 27 01:55 .
drwxr-xr-x 10 deploy deploy 4096 Nov 27 05:18 ..
-rw-------  1 deploy deploy 3724 Nov 27 12:37 authorized_keys
-rw-r--r--  1 deploy deploy 1326 Nov 27 01:57 known_hosts

also, I tried to add keys to ssh-agent. but fails.

deploy@xx.xx.xx.xx:~/.ssh$ eval "$(ssh-agent -s)"
Agent pid 4417
deploy@xx.xx.xx.xx:~/.ssh$ ssh-add ~/.ssh/authorized_keys
Error loading key "/home/deploy/.ssh/authorized_keys": invalid format

Does server side will only have my public-key. right? not the private key. am I on the right tracks?

UPDATE 1

With @ZedTuX suggest,

I generated another ssh-key set on the server-side. and added public key to github repo so that it can read/write. so I tested git pull and push on the server side. it works. bit still getting this error. when I try to deploy in my local.

 DEBUG [1b7b3349]   error: could not lock config file config: Permission denied
 DEBUG [1b7b3349]   fatal: could not set 'remote.origin.url' to 'git@github.com:maskeduser1/repo1.git'

It doesn't make sense to me, As I can even --set-upstream to Github. Why I am getting this error?

"Deploy keys" doesn't give read/write access, it gives only read access (which is what you want for a server). — ZedTuX, Nov 28 '19 at 05:10

ZedTuX · Answer 1 · 2019-11-28T05:29:29.150

I already copied my local - public key

That's not the way it work.

First of all, don't use your dev SSH key to deploy to your servers. This key has read and write rights, which is dangerous. In the case someone introduce your server, he would have a full read/write access to your Github repository source code.

Instead use Deploy keys (On Github, "Settings > Deploys keys"). So you generate a new SSH key on your server using ssh-keygen, then you copy/past the public SSH key from your server in the Deploy keys page.

After that you should be able to deploy.

Update

So now you have this error:

DEBUG [1b7b3349]   error: could not lock config file config: Permission denied
DEBUG [1b7b3349]   fatal: could not set 'remote.origin.url' to 'git@github.com:maskeduser1/repo1.git'

Can you please show the output of:

whoami
ls -al ~/.ssh
ls -al /<Capistrano :deploy_to>/repo

For the capistrano repo folder, have a look to the :deploy_to setting. In the case you didn't change it, it should be in the /var/www/ folder.

It did something. so I went to further. but still getting different errors. Updated post. — Jin Lim, Nov 27 '19 at 15:37

Capistrano rails app deploying fails. Server can't identificate self to Github. Permission denied (publickey)

1 Answers1

Update