Ssh hangs with pledge: fork

Greetings.
I’ve been trying to use git pull/push and ssh is hanging in a message debug1: pledge: fork.

I thought that maybe I had some bad config so I commented all the content in ~/.ssh/config and /etc/ssh/ssh_config and /etc/ssh/ssh_known_hosts

I then opened a new pure shell with

nix-shell -p git -p openssh --pure

and this was the output:

[nix-shell:~/codes/project]$ GIT_SSH_COMMAND='ssh -v' git pull
OpenSSH_9.5p1, OpenSSL 3.0.11 19 Sep 2023
debug1: Reading configuration data /home/hydrocat/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to git.<redacted>.com [<redacted-ip>] port <redacted-port>.
debug1: Connection established.
debug1: identity file /home/hydrocat/.ssh/id_rsa type 0
debug1: identity file /home/hydrocat/.ssh/id_rsa-cert type -1
debug1: identity file /home/hydrocat/.ssh/id_ecdsa type -1
debug1: identity file /home/hydrocat/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/hydrocat/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/hydrocat/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/hydrocat/.ssh/id_ed25519 type -1
debug1: identity file /home/hydrocat/.ssh/id_ed25519-cert type -1
debug1: identity file /home/hydrocat/.ssh/id_ed25519_sk type -1
debug1: identity file /home/hydrocat/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/hydrocat/.ssh/id_xmss type -1
debug1: identity file /home/hydrocat/.ssh/id_xmss-cert type -1
debug1: identity file /home/hydrocat/.ssh/id_dsa type -1
debug1: identity file /home/hydrocat/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.5
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.6p1 Ubuntu-4ubuntu0.7
debug1: compat_banner: match: OpenSSH_7.6p1 Ubuntu-4ubuntu0.7 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug1: Authenticating to git.<redacted>.com:<redacted-port> as 'git'
debug1: load_hostkeys: fopen /home/hydrocat/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:Bde2CAq66Z8cQ1N03InZY3qZ3VdB/SddyOjm51vMTYs
debug1: load_hostkeys: fopen /home/hydrocat/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host '[git.<redacted>.com]:<redacted-port>' is known and matches the ED25519 host key.
debug1: Found key in /home/hydrocat/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: /home/hydrocat/.ssh/id_rsa RSA SHA256:Ry9Ow47AYqrTlhQBfDdaNzqZrFx/iP5qWSWteLT0gcE
debug1: Will attempt key: /home/hydrocat/.ssh/id_ecdsa
debug1: Will attempt key: /home/hydrocat/.ssh/id_ecdsa_sk
debug1: Will attempt key: /home/hydrocat/.ssh/id_ed25519
debug1: Will attempt key: /home/hydrocat/.ssh/id_ed25519_sk
debug1: Will attempt key: /home/hydrocat/.ssh/id_xmss
debug1: Will attempt key: /home/hydrocat/.ssh/id_dsa
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/hydrocat/.ssh/id_rsa RSA SHA256:Ry9Ow47AYqrTlhQBfDdaNzqZrFx/iP5qWSWteLT0gcE
debug1: Server accepts key: /home/hydrocat/.ssh/id_rsa RSA SHA256:Ry9Ow47AYqrTlhQBfDdaNzqZrFx/iP5qWSWteLT0gcE
Enter passphrase for key '/home/hydrocat/.ssh/id_rsa':
Authenticated to git.<redacted>.com ([<redacted-ip>]:<redacted-port>) using "publickey".
debug1: channel 0: new session [client-session] (inactive timeout: 0)
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: filesystem
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: client_input_hostkeys: searching /home/hydrocat/.ssh/known_hosts for [git.<redacted>.com]:<redacted-port> / (none)
debug1: client_input_hostkeys: searching /home/hydrocat/.ssh/known_hosts2 for [git.<redacted>.com]:<redacted-port> / (none)
debug1: client_input_hostkeys: hostkeys file /home/hydrocat/.ssh/known_hosts2 does not exist
debug1: Remote: Forced command.
debug1: Remote: Port forwarding disabled.
debug1: Remote: X11 forwarding disabled.
debug1: Remote: Agent forwarding disabled.
debug1: Remote: PTY allocation disabled.
debug1: Remote: Forced command.
debug1: Remote: Port forwarding disabled.
debug1: Remote: X11 forwarding disabled.
debug1: Remote: Agent forwarding disabled.
debug1: Remote: PTY allocation disabled.
debug1: Sending environment.
debug1: channel 0: setting env GIT_PROTOCOL = "version=2"
debug1: Sending command: git-upload-pack '/active/meiller/kpi-midrive-documentation.git'
debug1: client_global_hostkeys_prove_confirm: server used untrusted RSA signature algorithm ssh-rsa for key 0, disregarding
debug1: update_known_hosts: known hosts file /home/hydrocat/.ssh/known_hosts2 does not exist
debug1: pledge: fork

I wish I knew how to reproduce this. The only thing I can think of was a shutdown while the computer was sleeping.

I am not sure as to what I should be asking google for, as pledge: fork seems to indicate that openssh is removing capabilities from itself but then, nothing comes out and eventually, a timeout kills the initial git command.

1 Like

seems to be a common problem, with a few trouble shooting idea here.

what version of nixos are you on? is this something that has just started happening after an upgrade? roll back and see if you solve the problem… .

we can then take it from there.

I reverted to my oldest upgrade. When I was sure that things were working and nixos-version says

$ nixos-version
23.05.4448.5550a85a087c (Stoat)

I re-read the link you mentioned and I am starting to think that it may be a problem with the gitlab server that I am using as the solutions in the link mention systemd-logind on the server side.

Maybe this is not a nixos mistake but git or ssh because for project in github, it works okay.

Okay, I was able to “fix it”

The gitlab instance was updated and I had to re-clone the repository.

The re-cloning maybe was necessary because of some misuse of git from my part.

interesting, i’m glad you fixed the problem… certainly not the greatest error message!!!

1 Like