Git FTP not finding pipeline SSH key
Asked by Dylan ten Donkelaar:

Hi, i've been trying to get a pipeline working which uses SSH keys and Git FTP. Past 2 days i've gotten the same error:

    SSH public key authentication failed: Unable to open public key file

I've tried changing the path, checked the keys, etc. I don't know how to actually access the keys and get the correct path for the pipeline to be able to find them. I've tested this locally in VS-code by specifying the path to the keys which are stored on my computer, and that does seem to work. Why i can not access the SSH key that i configured in the repository settings is beyond me.

I've searched everywhere and found that the pipeline doesn't know what to do with \~/. If someone could provide me the actual path i'm supposed to use to grab the keys, that would be great.

My current pipeline file:
>
> ```
> image: node:15.12.0
>
> definitions:
> caches:
> node: wp-content/themes/webpack/node_modules
> pipelines:
> branches:
> master:
> - step:
> name: Install node & deploy to production
> script:
> - apt-get update -y
> - apt-get install -y ssh
> - apt-get install -y libssh2-1-dev
> - apt-get -qq install git-ftp
> - ls -a /opt/atlassian/pipelines/agent/ssh/
> - ls -a ~/.ssh/config
> - git ftp push -vv --insecure -u $USER --key /opt/atlassian/pipelines/agent/ssh/id_rsa --pubkey /opt/atlassian/pipelines/agent/ssh/id_rsa.pub sftp://$SFTP_URL
> ```


Answers:
author: Theodora Boudale
body: Hi [@Dylan ten Donkelaar](/t5/user/viewprofilepage/user-id/3990036),

The SSH key should be located at

```
/opt/atlassian/pipelines/agent/ssh/id_rsa
```

Could you please check if you can connect to your server using the path above?

I'll check with my team internally to see if there have been any changes, as I see that the path mentioned in our docs is \~/.ssh/my_ssh_key.

Kind regards,  
Theodora

comments: author: Dylan ten Donkelaar
body: Hi [@Theodora Boudale](/t5/user/viewprofilepage/user-id/818086)

Thank you for replying. The public key is indeed in that location. I've checked with ls -la /opt/atlassian/pipelines/agent/ssh, returning a id_rsa and a id_rsa.tmp. Git-ftp still can not seem to find it.

I've also checked the \~/root/.ssh/config for the private key file but there's no key to be found there, even though the SSH-key settings in the repo say that a default identity of the private key is supposed to be in that folder.


author: Dylan ten Donkelaar
body: Hi [@Theodora Boudale](/t5/user/viewprofilepage/user-id/818086)

Our hosting provider just helped me find the solution.

The following lines did the trick:

```
- ssh-keygen -y -f /opt/atlassian/pipelines/agent/ssh/id_rsa > /tmp/id_rsa.pub
- git ftp push -vv --insecure -u $USER --key /opt/atlassian/pipelines/agent/ssh/id_rsa --pubkey /tmp/id_rsa.pub sftp://$SFTP_URL
```

I will keep this thread just in case anyone else stumbles upon the same issue.


author: Theodora Boudale
body: Hi [@Dylan ten Donkelaar](/t5/user/viewprofilepage/user-id/3990036),

Thank you for posting this for future reference for other users.

I just wanted to add here some notes as well for clarification:

It's actually the public key that cannot be found, */opt/atlassian/pipelines/agent/ssh/id_rsa* is the path of the private SSH key.

The command you included from your hosting provider

```
- ssh-keygen -y -f /opt/atlassian/pipelines/agent/ssh/id_rsa > /tmp/id_rsa.pub
```

generates the public SSH key from the private one and stores it in */tmp/id_rsa.pub*, so you can use it as an argument in the git ftp command.

Another way to solve this would be to copy the public key from **Repository settings** **\> SSH keys** and include the following command in the yml file:

```
- echo "paste_public_key_here" >> /tmp/id_rsa.pub
```

Kind regards,  
Theodora


author: Dylan ten Donkelaar
body: Edit: nevermind.


author: Christian Sciberras
body: The private key doesn't seem to exist, even the i[d_rsa_tmp mentioned here](https://confluence.atlassian.com/bbkb/unable-to-read-or-use-the-ssh-key-inside-the-custom-pipe-1155473263.html) (or elsewhere named id_rsa.tmp).

```
+ ls -la /opt/atlassian/pipelines/agent/ssh
total 4
drwxrwxrwt 3 root root  100 Jul 5 17:13 .
drwxr-xr-x 8 root root 4096 Jul 5 17:13 ..
drwxr-xr-x 2 root root   60 Jul 5 17:13 ..2024_07_05_17_13_09.3906268909
lrwxrwxrwx 1 root root   32 Jul 5 17:13 ..data -> ..2024_07_05_17_13_09.3906268909
lrwxrwxrwx 1 root root   18 Jul 5 17:13 known_hosts -> ..data/known_hosts

+ ls -la /opt/atlassian/pipelines/agent/ssh/..data/
total 4
drwxr-xr-x 2 root root   60 Jul 5 17:13 .
drwxrwxrwt 3 root root  100 Jul 5 17:13 ..
-rw-r--r-- 1 root root 1665 Jul 5 17:13 known_hosts

+ ssh-keygen -y -f /opt/atlassian/pipelines/agent/ssh/id_rsa > /tmp/id_rsa.pub
/opt/atlassian/pipelines/agent/ssh/id_rsa: No such file or directory

```

Interestingly, BITBUCKET_SSH_KEY_FILE also points to the non-existent id_rsa file.


author: Theodora Boudale
body: Hi Christian,

You need to generate an SSH key pair in Pipelines first or add your own. If you are a repo admin, you can do this from **Repository settings** \> section **PIPELINES - SSH Keys**.

If you're still experiencing issues, please create a new question instead of replying here. It's best to have a separate question per issue, as a certain post may become convoluted and diffcult to follow if we try to troubleshoot multiple users' issues in it.

Kind regards,  
Theodora


author: Christian Sciberras
body: Hello Theodora,

Thanks for confirming that!

Just a suggestion: would be nice to see it mentioned more often in the documentation (for instance [the link I already posted](https://confluence.atlassian.com/bbkb/unable-to-read-or-use-the-ssh-key-inside-the-custom-pipe-1155473263.html) doesn't mention that it needs to be set up first, neither is it [mentioned in the env var documentation](https://support.atlassian.com/bitbucket-cloud/docs/variables-and-secrets/#:~:text=BITBUCKET_SSH_KEY_FILE) despite the fact that the env var does exist and points to a non-existent file - which is very confusing).

Best,  
Chris.


Tags: bitbucket-cloud

bitbucket-pipelines

ftp

git

ssh