By mlhess on

On July 9th 8pm UTC, Drupal.org migrated to a redundant cluster of 2 servers. This provides failover in the event one server fails.

After the migration Host keys will change and your client might give an error message when pushing to Git. Consult your OS’s documentation on how to fix this error. For most operating systems, the following should remove the errors:

ssh-keygen -R git.drupal.org  && ssh-keygen -R 140.211.10.43

If you have any questions please raise an issue in the infrastructure issue queue. https://www.drupal.org/project/issues/infrastructure?categories=All

You can follow the progress of the migration at http://twitter.com/drupal_infra

Update: migration was successful

Host keys have changed and your client might give an error message when pushing to Git. The new host key is:

2048 16:f5:44:6c:a1:c6:be:72:cd:98:b5:b7:7d:26:d6:14 git.drupal.org (RSA)

Comments

briankeanton’s picture

briankeanton commented

A 2 server redundant cluster is great for recovery and longer up time for the system.
Thanks!

Marinade’s picture

Marinade commented

Sorry for newbie question but :
Will this change something for us if we have a drupal website (API ??) ???
Or it is only for commit on this website ?
Thanks in advance

moshe weitzman’s picture

moshe weitzman commented

Your ability to commit to your own repository is unaffected. This mostly affects Contrib module maintainers. Your own web site is is generally unaffected although your developers could feel a little pain if you use a Drush Make workflow, for example. In that case a rebuild of your site could require talking to git.drupal.org which will be unavailable.

Marinade’s picture

Marinade commented

Ok, thank you for your complete answer Moshe.

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented

"Host keys have changed and your client might give an error message when pushing to Git. Consult your OS’s documentation on how to fix this error."

A little bit more help, since this will block you entirely from doing anything with Git:

Remove the "git.drupal.org" entry from /$HOME_DIRECTORY/.ssh/known_hosts.

basic’s picture

basic commented

Run the following in your terminal: ssh-keygen -R git.drupal.org && ssh-keygen -R 140.211.10.43

I've updated the message to make this more clear as well.

helmo’s picture

helmo commented

What is the new key fingerprint?

Do you have a AegirCoop support subscription? See https://www.aegirproject.org/#support

basic’s picture

basic commented

@helmo and everyone, this is the new fingerprint:

2048 16:f5:44:6c:a1:c6:be:72:cd:98:b5:b7:7d:26:d6:14 git.drupal.org (RSA)
coredumperror’s picture

coredumperror commented

I'm just adding "The RSA host key for git.drupal.org has changed" as a comment here, so Google can find this page. That's the exact error message you get when you try to do git stuff with the old host key in place, so I figure people will be googling for that.

basic’s picture

basic commented

Thank you!

Danny Englander’s picture

Danny Englander
(he/him)
commented

I cannot commit to my repo now. I am getting this error:

Pushing to highrockmedia@git.drupal.org:project/gratis.git
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

I ran:

ssh-keygen -R git.drupal.org && ssh-keygen -R 140.211.10.43

...and that seemed to rename my known hosts file. I then added:

2048 16:f5:44:6c:a1:c6:be:72:cd:98:b5:b7:7d:26:d6:14 git.drupal.org (RSA)

...to the known host file but still no joy. I also re-added my key locally:

ssh-add ~/.ssh/mykey_dsa

Any ideas what I am doing wrong?

Danny Englander | Twitter | Instagram

Danny Englander’s picture

Danny Englander
(he/him)
commented

For those who run into the same issue as I did above, the key to fix it is to run this command:

ssh [your_git_username]@git.drupal.org

You'll then get a prompt if you want to connect:

The authenticity of host 'git.drupal.org (140.211.10.43)' can't be established.
RSA key fingerprint is 16:f5:44:6c:a1:c6:be:72:cd:98:b5:b7:7d:26:d6:14.
Are you sure you want to continue connecting (yes/no)?

I responded with yes.

You'll get a response with something like this:

Warning: Permanently added 'git.drupal.org,140.211.10.43' (RSA) to the list of known hosts.
PTY allocation request failed on channel 0
shell request failed on channel 0

That then added the new entry into my new known_hosts file

git.drupal.org,140.211.10.43 ssh-rsa AAAAB3Nz etc.. etc...

... and after that, voila, I was able to push with Git to my drupal repo.

Danny Englander | Twitter | Instagram

gausarts’s picture

gausarts commented

For unlucky windows users, just hit Yes after being prompted with a "WARNING - POTENTIAL SECURITY BREACH!" window, and making sure the new host key matches the above-mentioned one. One click away for the clicky itchy finger.

love, light n laughter

Mile23’s picture

Mile23
Primary language English
Location Seattle, WA
commented

First you do that ssh-keygen -R ... command above.

Then you'll retry your clone or whatever, and ssh will complain about the host:

$ git clone --branch 8.x-1.x [yourUsername]@git.drupal.org:project/examples.git
Cloning into 'examples'...
The authenticity of host 'git.drupal.org (140.211.10.43)' can't be established.
RSA key fingerprint is 16:f5:44:6c:a1:c6:be:72:cd:98:b5:b7:7d:26:d6:14.
Are you sure you want to continue connecting (yes/no)?

You'll see that RSA fingerprint, which you should compare to the fingerprint in this notice. :-)

If it's the same, then answer 'yes.'

And then you're done.

anon’s picture

anon
Primary language Swedish
Location Gothenburg
commented

I got the fingerprint in SHA256.

The authenticity of host 'git.drupal.org (140.211.10.43)' can't be established.
RSA key fingerprint is SHA256:Fbjx4sCN5lCL9NvqsQ6MA1SMGZmJrYxYeSblSFRIXi4.
Are you sure you want to continue connecting (yes/no)?

To get the fingerprint in MD5 format do:

ssh -o FingerprintHash=md5 git.drupal.org

The authenticity of host 'git.drupal.org (140.211.10.43)' can't be established.
RSA key fingerprint is MD5:16:f5:44:6c:a1:c6:be:72:cd:98:b5:b7:7d:26:d6:14.
Are you sure you want to continue connecting (yes/no)?
daniel.stewart’s picture

daniel.stewart commented

This is great! Redundancy is key! This website is very large and resourceful! I will follow the progress to learn more on applying the same to our website. Thanks

Gomesh’s picture

Gomesh commented

Thanks , Its resolve my problem .