44

I am working on a project with my teammates. Some weeks ago, I pulled the project from git successfully. But today when I wanted to pull the updated project via the command "git pull origin <my_branch>", it gave me the following error:

client_global_hostkeys_private_confirm: server gave bad signature for RSA key 0

I have generated the public key using the command ssh-keygen and then pasted the content of the new generated file id_rsa.pub in the "Add an SSH key" section of Git, But the pull command did not work. Could somebody help me?

1

1 Answer 1

97

The message "client_global_hostkeys_private_confirm: server gave bad signature for RSA key 0" is not an error, it is a warning, and it is related to some ssh versioning issue. It used to be very common to receive from GitLab.

If you want it to go away, you can make sure that your ~/.ssh/config contains the following:

Host gitlab.com
    UpdateHostKeys no

However, if you are in fact being prevented from pulling, then this bad signature warning is probably not the reason. Once you make the warning go away, you will still have to find the real problem that you have, about which we know nothing, as the question stands right now.

UPDATE

Regarding potential side-effects of using UpdateHostKeys no, and risks of masking some serious problem in some other context, (as user J. B. Rainsberger poignantly asked in a comment,) user Mark Roberts commented:

according to the ssh_config man-page, setting UpdateHostKeys no reduces security risks. It means that when a server has an old key (which your client has just accepted) and a new key (which the server wishes the client to remember for future use) the client will not accept the new key. Usually you want to trust a server who's old key you have already accepted, therefore the default is UpdateHostKeys yes. But there are cases (as in this question) where the automatic key updating mechanism doesn't work. It is safe to turn it off.

6
  • 11
    What potential side-effects would this have? Does it risk masking a serious problem in some other context? Commented Jul 10, 2021 at 10:42
  • 5
    If this is the first time you have created ~/.ssh/config, make sure you also give it the correct permissions with chmod 0600 ~/.ssh/config to prevent the error "Bad owner or permissions on [..]" Commented Aug 9, 2021 at 3:09
  • 1
    @MikeNakis No, I have no additional wisdom to share. Thank you for checking. Commented Nov 23, 2023 at 16:09
  • 2
    @MikeNakis, @J.B.Rainsberger: according to the ssh_config man-page, setting UpdateHostKeys no reduces security risks. It means that when a server has an old key (which your client has just accepted) and a new key (which the server wishes the client to remember for future use) the client will not accept the new key. Usually you want to trust a server who's old key you have already accepted, therefore the default is UpdateHostKeys yes. But there are cases (as in this question) where the automatic key updating mechanism doesn't work. It is safe to turn it off. Commented Sep 3 at 8:05
  • 1
    @J.B.Rainsberger FYI ^^^
    – Mike Nakis
    Commented Sep 4 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.