I tried the solution provided by the first link you provided, but the file is read-only.
Use…
$ sudo vim /etc/ssh/ssh_config
As for the second solution suggested below, I don’t know how to do the same
Fixed! The cause is dns pollution… After I modify the hosts and set a new IP for github.com, I can pass the ssh -T test.
Search for: clear dns cache on YOUR_PLATFORM
I got warnings saying something like being attacked, and suggest me to change or delete things in known_hosts. After deleting all the items inside known_hosts, the warnings are gone
Sometimes the server key changes legitimately, but blindly removing the server-key from known_hosts defeats the security check. Not all services publish their server-key, but many do that you can google for. Here is github’s… “GitHub's SSH key fingerprints - GitHub Docs”
I’ve copied the page here as an image in the unlikely event docs.github.com is spoofed for you.
Not to be alarmist, since its often a legitimate misconfiguration somewhere, but this possibly indicates a man-in-the-middle attack, so it may be pragmatic to change the password you’ve been typing in, maybe wherever you use it, but particularly on github.
[EDIT: It could also be that your upstream ISP has had their “DNS” servers hacked or “poisoned”.]
I’m a novice at interpretting the ssh debug output, and actually trying to learn more just now, there are suggestions more verbosity is useful using “-Tvvv”, but here goes…
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
I think this is okay and not relevant. From the man page… “SSH_SK_PROVIDER specifies a path to a library that will be used when loading any FIDO authenticator-hosted keys, overriding the default of using the built-in USB HID support.”
debug1: identity file /Users/Natsume/.ssh/id_ed25519 type 3
debug1: identity file /Users/Natsume/.ssh/id_ed25519-cert type -1
It found your key. Github help indicate it acceptes this type (and it was working before)
debug1: Server host key: ssh-rsa SHA256:rEmlJenVMSL5GVemSY0Gk8WGw6B4ege4J85M+vup8R0
debug1: Found key in /Users/Natsume/.ssh/known_hosts:1
This may indicate a problem/attack. The “fingerprints” link above indicates the server host key key should be:
SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8
Now compare this next bit…
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: /Users/Natsume/.ssh/id_ed25519 ED25519 SHA256:UFKLp/rN0o7czWwT5DukRK6TL2GyxKzfX8alHvlIimc explicit agent
debug1: Authentications that can continue: publickey,password,keyboard-interactive
to mine…
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/ben/.ssh/id_ecdsa ECDSA SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxx
debug1: Server accepts key: /home/ben/.ssh/id_ecdsa ECDSA SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxx
debug1: Authentication succeeded (publickey).
I’m not completely sure why I only have publickey method compared to yours.
My ssh_config file doesn’t have PasswordAuthentication no
which man ssh_config indicates it defaults to yes.
It could be because github don’t allow ssh-password authentication but you are connecting to a false MITM github server which “allows” password so you will share your password with the attacker. You can examine that by using any third-party dns lookup tool.
Like this one… Dig (DNS lookup) …which currently shows for me as 140.82.112.3. The IP address may legitimately be different to the IP address your local machine resolves github.com to, since the third-party server is in a different location around the world (indeed I resolve github.com to 20.248.137.48). The point is simply to get a second IP address to conenct directly to without DNS, and see if you now get the server-host-key specified in github docs…
$ ssh -Tv git@140.82.112.3
