GitHub suddenly rejected my SSH key (the fix was a .pub file?!) - Erik Thorsell
Erik Thorsell
DevOps Transformation Leader trying to automate the world.
Follow
Resumé
GitHub
Mastodon
Custom Social Profile Link
-->
Today, git pull stopped working on my main laptop. Permission denied (publickey), out of nowhere. I had changed<br>nothing, the key was still registered on GitHub, and pulling the same repository from another laptop (with another key)<br>worked fine.
The rabbit hole
I’ll spare you the full troubleshooting session1. The key was mathematically sound (openssl rsa<br>-check said RSA key ok), the signature algorithm was the modern rsa-sha2-512, my ~/.ssh/config was clean, and<br>GitHub’s status page was all green. Still: Permission denied.
The fix turned out to be embarrassingly small. My ~/.ssh/github_rsa has lived without a companion .pub file since I<br>re-installed my laptop. Generating one made authentication work again:
$> ssh-keygen -y -f ~/.ssh/github_rsa > ~/.ssh/github_rsa.pub
I did not believe it either, so I tested it six times with the .pub file and six times without. Twelve out of twelve:<br>no .pub – rejected, .pub – accepted.
Why on earth would that matter?
Because the .pub file changes which authentication flow OpenSSH uses. With a .pub file present, the client first<br>probes (offers the public key, waits for the server’s OK) and only then signs. With only a private key, OpenSSH skips<br>the probe and sends a fully signed authentication request directly. Both flows are perfectly legal according to RFC<br>4252, and a stock sshd accepts both.
GitHub, as of today, apparently does not.
Did something change on GitHub’s side?
My money says yes. The server banner in my debug logs reads 6a2c000, where GitHub’s SSH frontend has historically<br>identified itself as babeld-. That smells like new server software – one that rejects direct-signed publickey<br>requests. It would explain perfectly why everything worked in the morning and nothing worked an hour later, on a machine<br>where nothing changed.
Has anyone else hit this? Do you know what 6a2c000 is? Let me know – and in the meantime: make sure your private keys<br>have their .pub siblings.
Everything from ssh -vvv archaeology, via openssl key validation, to a controlled 12-trial experiment. ↩
Share on
Bluesky
You May Also Enjoy
State of the Homelab 2026 (Network edition)
6 minute read
This is a follow-up post to my State of the Homelab 2026 (Servers Edition)-post, which talks about my storage / compute philosophy, how my server game has<br>ev...
State of the Homelab 2026 (Servers edition)
6 minute read
This post is long overdue, but I’m planning some upgrades for 2026 so I figured I’d document the setup that has been<br>serving me very well for the past 5 year...
Kubernetes exposes your DevOps debt
5 minute read
Kubernetes is a point of contention.
Estimates – a necessary evil?
11 minute read
Product Owner: Hey, how long do you believe Feature F will take?
Developer: Idk. We haven’t even started working on it and it’s bound to stir up some o...
Enter your search term...