I recently set up Fedora 33 and was migrating over my files. I copied over my ssh keys and found that I could no longer pull from bitbucket git repos I was able to pull from on my old laptop. The ssh keys are exactly the same, and the public key is already on the bitbucket account. Additionally the permissions were set to chmod 600
. I still can not pull from the repo.
2 Answers
This seems to be a recent issue around Fedora 33. This is the relevant bug report.
The issue is that it seems like Fedora 33 removed support for SHA1
, and I guess bitbucket.org
uses SHA1
for their git clone
via ssh
. You can verify if this is the same issue by running ssh -Tv git@bitbucket.org
and grep
the output for debug1: send_pubkey_test: no mutual signature algorithm
.
The current workaround, as listed in the bug report, is to explicitly specify ssh-rsa
support in your ~/.ssh/config
:
Add the following entry to your ~/.ssh/config
and make sure it has the permission chmod 700 ~/.ssh/config
Host bitbucket.org
User git
PubkeyAcceptedKeyTypes ssh-rsa
Replace bitbucket.org
with whatever git host you are using
-
2That's not what
bitbucket
uses, it's what you choose when creating your keypair.– tinkFeb 13, 2021 at 18:31 -
The issue is also present in cygwin and fixed like shown in this answer May 8, 2021 at 19:41
-
Just switched from Centos 8 to Fedors 34 and ran into this exact issue. I like the idea of using
~/.ssh/conifg
to turn SHA1 back on for jjust this one site. Aug 16, 2021 at 2:46
Proper solution: use ssh-keygen -t ed25519
and copy that public key into your bitbucket account.
-
1I only use ed25519 keys and still Bitbucket started complaining after updating OpenSSH to 8.8. It does really seem they only support legacy key types on their servers (ssh-rsa,ssh-dss).– mcilloniSep 27, 2021 at 8:19