SSH connections to github.com stopped working with host key mismatch #7723

jannfis · 2021-11-16T20:41:05Z

Describe the bug

On Nov. 16th, GitHub.com has made changes to their SSH endpoint that prevents Argo CD to connect to github.com repositories when using the SSH protocol. More details can be found here: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints

The error message observed is:

rpc error: code = Unknown desc = ssh: handshake failed: knownhosts: key mismatch

Determining the root cause is still under progress, but we believe it's a combination of GitHub.com changing the host key algorithm preference to ECDSA or Ed25519 and Argo CD not shipping the appropriate keys, which leads to our SSH implementation refusing to continue. Argo CD does not, nor did, use DSA as the protocol for validating SSH host keys.

Workaround

As a workaround, you need to import the new ECDSA and Ed25519 keys into Argo CD's SSH known hosts configuration.

First, get the new host keys using ssh-keyscan, which is part of OpenSSH's client package:

$ ssh-keyscan github.com
# github.com:22 SSH-2.0-babeld-a73e1397
github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
# github.com:22 SSH-2.0-babeld-a73e1397
github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
# github.com:22 SSH-2.0-babeld-a73e1397
github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl

Then, run argocd cert add-ssh --batch and paste the keys to the terminal when asked to do so. Alternatively, you can use the UI or declarative setup for adding the new keys. Please refer to the documentation for more details.

Important Make sure to verify the fingerprints of the keys to match the fingerprints on https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints - Argo CD helps you to view the fingerprints using the argocd cert list command.

A fix for adding the new keys to Argo CD is being worked on here: #7722

Update Nov 18 2022

Argo CD v2.1.7 has been released with updated manifests containing the new host keys in the argocd-known-hosts-cm ConfigMap. Please note that it is not sufficient to update your image tags to the new version, since the host keys are stored in a ConfigMap and are not part of the container image. You need to apply v2.1.7 manifests when upgrading.

The text was updated successfully, but these errors were encountered:

paul-civitas · 2021-11-16T20:59:13Z

I added the host keys on my laptop thinking "I can connect to github should be fine" and that didn't fix it.

But this did, adding all the ones returned from a keyscan. Very strange.

joaopaulosr95 · 2021-11-16T21:03:10Z

Thank you so much @jannfis, it worked smoothly 😄

paul-civitas · 2021-11-16T21:05:55Z

Distressing that argoCD hardcoded in a DSA verification key like that.

paul-civitas · 2021-11-16T21:07:04Z

Rather than "adding the new keys" to argoCD how about implementing an actual ssh handshake process and flow?

Cicatrice · 2021-11-16T21:32:48Z

Thanks for this fix.

~~I don't know who is in charge of argo-helm ; but this fix is to propagate here too https://github.com/argoproj/argo-helm/blob/master/charts/argo-cd/values.yaml#L1485~~

Edit: Fix is propagated : argoproj/argo-helm@27aa2a9

Kampe · 2021-11-16T22:02:03Z

same issues for us

joshdk · 2021-11-16T22:22:42Z

I had to fix this earlier today, so wanted to share.

Remediation Steps

1. Create a file named `argocd-ssh-known-hosts-cm.yaml` with the following contents:

apiVersion: v1
kind: ConfigMap

metadata:
  name: argocd-ssh-known-hosts-cm
  labels:
    app.kubernetes.io/name: argocd-ssh-known-hosts-cm

data:
  ssh_known_hosts: |
    bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==
    github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
    github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
    github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
    gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=
    gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf
    gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9
    ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
    vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H

⚠️ You might need to edit labels/annotations to match your existing configmap.

2. Apply the `argocd-ssh-known-hosts-cm.yaml` file:

$ kubectl apply --file argocd-ssh-known-hosts-cm.yaml
configmap/argocd-ssh-known-hosts-cm configured

⚠️ Make sure you are targeting the correct context and namespace

3. Restart the `argocd-repo-server` pods:

$ kubectl delete pod --selector app.kubernetes.io/name=argocd-repo-server

Afterwards, things in the ArgoCD UI should update, and any "unknown" applications should sort themselves out. Cheers!

StevenBarre · 2021-11-16T22:56:27Z

the Go SSH client also doesn’t yet support RSA with SHA-2, so we recommend using an Ed25519 key there

https://github.blog/2021-09-01-improving-git-protocol-security-github/#libgit2-and-other-git-clients

I believe that's why its having issues despite not using DSA.

iamnoah · 2021-11-16T23:03:39Z

@jannfis thanks for pining this and getting the information out so quickly. I also appreciate that Argo has done 99% of the administration work that we as users are ultimately responsible for here in maintaining our own installations, and that there is an easy workaround.

ruibinghao · 2021-11-16T23:14:22Z

Thanks for providing the quick workaround. This bailed us out from a 2-hour long troubleshooting session.

eytanhanig · 2021-11-16T23:30:44Z

Here's the Kustomize code.

The overlay file:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-ssh-known-hosts-cm
data:
  ssh_known_hosts: |
    bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==
    github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
    github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
    github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
    gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=
    gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf
    gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9
    ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
    vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H

The kustomize.yaml to use the overlay (change filename/path and namespace as needed):

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: argocd
patchesStrategicMerge:
- overlays/argocd-ssh-known-hosts-cm.yaml

joshdk · 2021-11-17T01:25:17Z

@eytanhanig another great way is to use a configMapGenerator.

Create a file named ssh_known_hosts with the following contents:

bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==
github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=
gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf
gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9
ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H

Then, reference it from a (existing) kustomization.yaml file:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

# Existing resources, patches, etc

configMapGenerator:
  - name: argocd-ssh-known-hosts-cm
    behavior: replace
    files:
      - ssh_known_hosts

josandstrom · 2021-11-17T07:46:34Z

Rather than "adding the new keys" to argoCD how about implementing an actual ssh handshake process and flow?

Its Open Source, feel free to contribute. Kudos to the ArgoCD team for all great work and for a fix.

idrissneumann · 2021-11-17T09:58:05Z

Already logged here: argoproj/argo-helm#1019
And fixed here: argoproj/argo-helm#1018 😄

tech4242 · 2021-11-17T14:27:16Z

first of all thx for flagging this!

.. but kind of lost on this one:

added ssh-ed25519 to known hosts for github.com
restarted repo server
argocd repocreds add git@github.com:xx/ --ssh-private-key-path ~/.ssh/argocd works with an ssh-ed25519 key.
argocd repo add git@github.com:xx/xx-config --ssh-private-key-path ~/.ssh/argocd fails with the handshake error

EDIT: needed to add github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg= as well

cyrilcros · 2021-11-17T15:10:31Z

Thank you so much for the fix. Can you please release a new version with it soon?

alexmt · 2021-11-17T21:44:24Z

Fixed by #7722 . The fix is available in v2.1.7 release

jsoref · 2021-11-18T13:29:58Z

Fwiw, here's an issue for the upstream component: go-git/go-git#411

rdonkin-attest · 2021-11-26T11:10:04Z

For anyone who wants a heads-up of similar GitHub changes in future - visit https://github.blog/security.atom for security related changes, and follow in an Atom feed reader. Or use a service such as https://blogtrottr.com/ to convert this into emails.

aslamkhan-dremio · 2021-12-14T12:16:02Z

@jannfis - I am seeing similar issue while connecting to source.developers.google.com repos. I have upgraded to v2.1.7 but not luck.

[source.developers.google.com]:2022 ecdsa-sha2-nistp256 XXXXXXXXX [source.developers.google.com]:2022 ssh-rsa XXXXXXXXXX [source.developers.google.com]:2022 ssh-ed25519 XXXXXXXXX

jannfis added the bug Something isn't working label Nov 16, 2021

jannfis pinned this issue Nov 16, 2021

jsoref mentioned this issue Nov 16, 2021

ssh validation error should have more information #7725

Open

brsolomon-deloitte mentioned this issue Nov 17, 2021

Host key mismatch #7736

Closed

1 task

alexmt closed this as completed Nov 17, 2021

alexmt unpinned this issue Nov 18, 2021

fivesheep mentioned this issue Nov 18, 2021

argocd cli throws ssh handshake error on app sync #7745

Closed

3 tasks

alexmt pinned this issue Nov 18, 2021

mosampaio mentioned this issue Nov 30, 2021

Bump argo-cd to 3.26.9+ DNXLabs/terraform-aws-eks-argocd#8

Closed

1 task

jannfis unpinned this issue Dec 1, 2021

jsoref mentioned this issue Jan 25, 2022

Ingest https://api.github.com/meta #8271

Open

toredash mentioned this issue May 16, 2023

fix: Update Bitbucket SSH host key argoproj/argo-workflows#11091

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SSH connections to github.com stopped working with host key mismatch #7723

SSH connections to github.com stopped working with host key mismatch #7723

jannfis commented Nov 16, 2021 •

edited

paul-civitas commented Nov 16, 2021

joaopaulosr95 commented Nov 16, 2021

paul-civitas commented Nov 16, 2021

paul-civitas commented Nov 16, 2021

Cicatrice commented Nov 16, 2021 •

edited

Kampe commented Nov 16, 2021

joshdk commented Nov 16, 2021 •

edited

StevenBarre commented Nov 16, 2021

iamnoah commented Nov 16, 2021

ruibinghao commented Nov 16, 2021

eytanhanig commented Nov 16, 2021

joshdk commented Nov 17, 2021

josandstrom commented Nov 17, 2021

idrissneumann commented Nov 17, 2021 •

edited

tech4242 commented Nov 17, 2021 •

edited

cyrilcros commented Nov 17, 2021

alexmt commented Nov 17, 2021

jsoref commented Nov 18, 2021

rdonkin-attest commented Nov 26, 2021

aslamkhan-dremio commented Dec 14, 2021 •

edited

SSH connections to github.com stopped working with host key mismatch #7723

SSH connections to github.com stopped working with host key mismatch #7723

Comments

jannfis commented Nov 16, 2021 • edited

paul-civitas commented Nov 16, 2021

joaopaulosr95 commented Nov 16, 2021

paul-civitas commented Nov 16, 2021

paul-civitas commented Nov 16, 2021

Cicatrice commented Nov 16, 2021 • edited

Kampe commented Nov 16, 2021

joshdk commented Nov 16, 2021 • edited

Remediation Steps

1. Create a file named argocd-ssh-known-hosts-cm.yaml with the following contents:

2. Apply the argocd-ssh-known-hosts-cm.yaml file:

3. Restart the argocd-repo-server pods:

StevenBarre commented Nov 16, 2021

iamnoah commented Nov 16, 2021

ruibinghao commented Nov 16, 2021

eytanhanig commented Nov 16, 2021

joshdk commented Nov 17, 2021

josandstrom commented Nov 17, 2021

idrissneumann commented Nov 17, 2021 • edited

tech4242 commented Nov 17, 2021 • edited

cyrilcros commented Nov 17, 2021

alexmt commented Nov 17, 2021

jsoref commented Nov 18, 2021

rdonkin-attest commented Nov 26, 2021

aslamkhan-dremio commented Dec 14, 2021 • edited

jannfis commented Nov 16, 2021 •

edited

Cicatrice commented Nov 16, 2021 •

edited

joshdk commented Nov 16, 2021 •

edited

1. Create a file named `argocd-ssh-known-hosts-cm.yaml` with the following contents:

2. Apply the `argocd-ssh-known-hosts-cm.yaml` file:

3. Restart the `argocd-repo-server` pods:

idrissneumann commented Nov 17, 2021 •

edited

tech4242 commented Nov 17, 2021 •

edited

aslamkhan-dremio commented Dec 14, 2021 •

edited