Git 错误：连接到远程存储库时“主机密钥验证失败”

Git error: "Host Key Verification Failed" when connecting to remote repository

提问by bootsz

I am trying to connect to a remote Git repository that resides on my web server and clone it to my machine.

我正在尝试连接到驻留在我的 Web 服务器上的远程 Git 存储库并将其克隆到我的机器上。

I am using the following format for my command:

我的命令使用以下格式：

git clone ssh://[email protected]/repository.git

This has worked fine for most of my team members. Usually after running this command Git will prompt for the user's password, and then run the cloning. However, when running on one of my machines I get the following error:

这对我的大多数团队成员都很有效。通常在运行此命令后，Git 会提示输入用户密码，然后运行克隆。但是，在我的其中一台机器上运行时，出现以下错误：

Host key verification failed.

fatal: Could not read from remote repository.

主机密钥验证失败。

致命：无法从远程存储库读取。

We are not using SSH keys to connect to this repository, so I'm not sure why Git is checking for one on this particular machine.

我们没有使用 SSH 密钥连接到这个存储库，所以我不确定为什么 Git 会在这台特定的机器上检查一个。

采纳答案by Greg Bacon

You are connecting via the SSH protocol, as indicated by the ssh://prefix on your clone URL. Using SSH, every host has a key. Clients remember the host key associated with a particular address and refuse to connect if a host key appears to change. This prevents man in the middle attacks.

您正在通过 SSH 协议进行连接，如ssh://克隆 URL 上的前缀所示。使用 SSH，每个主机都有一个密钥。客户端记住与特定地址关联的主机密钥，如果主机密钥发生变化，则拒绝连接。这可以防止中间人攻击。

The host key for domain.com has changed. If this does not seem fishy to you, remove the old key from your local cache by editing ${HOME}/.ssh/known_hoststo remove the line for domain.com or letting an SSH utility do it for you with

domain.com 的主机密钥已更改。如果这对您来说并不可疑，请通过编辑${HOME}/.ssh/known_hosts删除 domain.com 的行或让 SSH 实用程序为您执行此操作来从本地缓存中删除旧密钥。

ssh-keygen -R domain.com

From here, record the updated key either by doing it yourself with

从这里，通过自己做来记录更新的密钥

ssh-keyscan -t rsa domain.com >> ~/.ssh/known_hosts

or, equivalently, let sshdo it for you next time you connect with git fetch, git pull, or git push(or even a plain ol' ssh domain.com) by answering yes when prompted

或者，等效地，让ssh您在下次与git fetch, git pull, 或git push（甚至是普通的 ol' ssh domain.com）连接时通过在提示时回答是来为您执行此操作

The authenticity of host 'domain.com (a.b.c.d)' can't be established.
RSA key fingerprint is XX:XX:...:XX.
Are you sure you want to continue connecting (yes/no)?

The reason for this prompt is domain.com is no longer in your known_hostsafter deleting it and presumably not in the system's /etc/ssh/ssh_known_hosts, so sshhas no way to know whether the host on the other end of the connection is really domain.com. (If the wrong key is in /etc, someone with administrative privileges will have to update the system-wide file.)

出现这个提示的原因是domain.comknown_hosts删除后已经不在你里面了，估计系统的也没有了/etc/ssh/ssh_known_hosts，所以ssh无法知道连接另一端的主机是否真的是domain.com。（如果错误的密钥在 中/etc，则具有管理权限的人将不得不更新系统范围的文件。）

I strongly encourage you to consider having users authenticate with keys as well. That way, ssh-agentcan store key material for convenience (rather than everyone having to enter her password for each connection to the server), and passwords do not go over the network.

我强烈建议您考虑让用户也使用密钥进行身份验证。这样，ssh-agent可以方便地存储密钥材料（而不是每个人都必须在每次连接到服务器时输入她的密码），并且密码不会通过网络。

回答by Tupy

As I answered previously in Cloning git repo causes error - Host key verification failed. fatal: The remote end hung up unexpectedly, add the GitHub to the list of authorized hosts:

正如我之前在克隆 git repo 中回答的那样导致错误 - 主机密钥验证失败。致命：远程端意外挂断，将GitHub添加到授权主机列表中：

ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts

ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts

回答by Saran

I had the similar issue, but, using SSH keys. From Tupy's answer, above, I figured out that the issue is with known_hosts file not being present or github.com not being present in the list of known hosts. Here are the steps I followed to resolve it -

我有类似的问题，但是，使用 SSH 密钥。从上面 Tupy 的回答中，我发现问题在于 known_hosts 文件不存在或 github.com 不存在于已知主机列表中。这是我解决它所遵循的步骤 -

1. mkdir -p ~/.ssh
2. ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts
3. ssh-keygen -t rsa -C "user.email"
4. open the public key with this command $ cat ~/.ssh/id_rsa.puband copy it.
5. Add the id_rsa.pubkey to SSH keys list on your GitHub profile.

1. mkdir -p ~/.ssh
2. ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts
3. ssh-keygen -t rsa -C "user.email"
4. 使用此命令打开公钥$ cat ~/.ssh/id_rsa.pub并复制它。
5. 将id_rsa.pub密钥添加到 GitHub 个人资料上的 SSH 密钥列表。

回答by Powderham

This is happening because github is not currently in your known hosts.

发生这种情况是因为 github 当前不在您的已知主机中。

You should be prompted to add github to your known hosts. If this hasn't happened, you can run ssh -T [email protected]to receive the prompt again.

应该会提示您将 github 添加到您的已知主机。如果这还没有发生，您可以运行ssh -T [email protected]以再次收到提示。

回答by Code-Apprentice

For me, I just had to type "yes" at the prompt which asks "Are you sure you want to continue connecting (yes/no)?" rather than just pressing Enter.

对我来说，我只需要在提示“您确定要继续连接（是/否）吗？”时输入“是”。而不仅仅是按 Enter。

回答by Geoffroy

I got the same problem on a newly installed system, but this was a udev problem. There was no /dev/ttynode, so I had to do:

我在新安装的系统上遇到了同样的问题，但这是一个 udev 问题。没有/dev/tty节点，所以我不得不这样做：

mknod -m 666 /dev/tty c 5 0

回答by sunil

If you are in office intranet (otherwise dangerous) which is always protected by firewalls simply have the following lines in your ~/.ssh/config

如果您在始终受防火墙保护的办公室内联网（否则很危险），只需在 ~/.ssh/config 中添加以下行

Host *
StrictHostKeyChecking no
UserKnownHostsFile=/dev/null

主机 *
StrictHostKeyChecking 没有
UserKnownHostsFile=/dev/null

回答by ghiscoding

What worked for me was to first add my SSH key of the new computer, I followed these instructions from GitLab - add SSH key. Note that since I'm on Win10, I had to do all these commands in Git Bash on Windows (it didn't work in regular DOS cmd Shell).

对我有用的是首先添加我的新计算机的 SSH 密钥，我按照GitLab 中的这些说明进行操作- add SSH key。请注意，由于我使用的是 Win10，因此我必须在 Windows 上的 Git Bash 中执行所有这些命令（它在常规 DOS cmd Shell 中不起作用）。

Then again in Git Bash, I had to do a git cloneof the repo that I had problems with, and in my case I had to clone it to a different name since I already had it locally and didn't want to lose my commits. For example

然后再次在 Git Bash 中，我不得不做一个git clone我遇到问题的 repo，在我的情况下，我不得不将它克隆到不同的名称，因为我已经在本地拥有它并且不想丢失我的提交。例如

git clone ssh://git@gitServerUrl/myRepo.git myRepo2

Then I got the prompt to add it to known hosts list, the question might be this one:

然后我得到了将它添加到已知主机列表的提示，问题可能是这个：

Are you sure you want to continue connecting (yes/no)?

您确定要继续连接吗（是/否）？

I typed "yes" and it finally worked, you should typically get a message similar to this:

我输入了“是”，它终于奏效了，您通常应该会收到类似于以下内容的消息：

Warning: Permanently added '[your repo link]' (ECDSA) to the list of known hosts.

警告：将“[your repo link]”（ECDSA）永久添加到已知主机列表中。

Note: if you are on Windows, make sure that you use Git Bash for all the commands, this did not work in regular cmd shell or powershell, I really had to do this in Git Bash.

注意：如果您使用的是 Windows，请确保对所有命令都使用 Git Bash，这在常规 cmd shell 或 powershell 中不起作用，我真的必须在 Git Bash 中执行此操作。

Lastly I deleted the second clone repo (myRepo2in the example) and went back to my first repo and I could finally do all the Git stuff like normal in my favorite editor VSCode.

最后，我删除了第二个克隆存储库（myRepo2在示例中）并返回到我的第一个存储库，我终于可以在我最喜欢的编辑器 VSCode 中像往常一样执行所有 Git 操作。

回答by Julian Knight

If you are using git for Windows.

如果您在 Windows 上使用 git。

• Open the git GUI.
• Open the local git repository in git GUI.
• Add the remote or push if the remote already exists.
• Answer "yes" to the question about whether you want to continue.

• 打开git GUI。
• 在 git GUI 中打开本地 git 存储库。
• 如果遥控器已经存在，则添加遥控器或推送。
• 对是否要继续的问题回答“是”。

The GUI client adds the key for you to ~/.ssh/known_hosts. This is easier to remember if you don't do it often and also avoids the need to use the git command line (the standard Windows command lines don't have the ssh-keyscanexecutable.

GUI 客户端将密钥添加到~/.ssh/known_hosts. 如果您不经常这样做，这会更容易记住，并且还避免了使用 git 命令行的需要（标准的 Windows 命令行没有ssh-keyscan可执行文件。

回答by Sandy

When the remote server wants to connect to the private repo, it would authenticate via ssh. Create the private-public key pair with ssh-keygen or if you already have the public-private key. copy&paste the public key in the Settings of the private repo.

当远程服务器想要连接到私有仓库时，它会通过 ssh 进行身份验证。使用 ssh-keygen 创建私钥-公钥对，或者如果您已经拥有公钥-私钥。在私有仓库的设置中复制并粘贴公钥。

YourPrivateRepo -> Settings -> Deploy Keys -> Add deploy key -> Paste the public key.

YourPrivateRepo -> 设置 -> 部署密钥 -> 添加部署密钥 -> 粘贴公钥。

Now the remote server would be able to connect to the private repo.

现在远程服务器将能够连接到私有仓库。

NOTE: The deploy keys has access only for reading the repo. Need to explicitly allow write access.

注意：部署密钥只能读取 repo。需要明确允许写访问。