# Separating the gitea and system ssh servers - **URL:** \ **Category:** Install/Maintain/Configure\ **Created:** [July 26, 2024, 5:08am UTC](https://forum.gitea.com/t/separating-the-gitea-and-system-ssh-servers/9506 "2024-07-26T05:08:59Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![pjgoodall](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/pjgoodall/32/2967_2.png) [@pjgoodall](https://forum.gitea.com/u/pjgoodall)\ **Post date:** [July 26, 2024, 5:08am UTC](https://forum.gitea.com/t/separating-the-gitea-and-system-ssh-servers/9506/1 "2024-07-26T05:08:59Z")
## Problem Statement: Gitea SSH Access Configuration in LXC Container ### Overview I am experiencing issues configuring Gitea to allow SSH access for cloning and pushing repositories. HTTP access for cloning works correctly. Despite two days of effort, I am unable to get the SSH access working as expected. Here are the details of my setup and the steps I have taken so far. ### System Details - **Host Environment** : Proxmox 8.2.4 LXC Container - **Base Image** : `debian-12-standard 12.2-1_amd64` - **Default SSH Daemon** : The system’s default `sshd` is installed and running. ### Requirements 1. **Gitea Access** : - HTTP access for browsing and cloning repositories. - SSH access for cloning and pushing to repositories. 2. **Authentication** : - Gitea users have verified ssh keys. - The system root user should also have SSH key login enabled. 3. **No SSL/TLS Certificates** : - For simplicity, no certificates should be required for the initial setup. ### Steps Taken 1. **Installed Gitea** : 2. **System SSH Daemon** : 3. **SSH Configuration** : ### Issues Encountered - When attempting to clone a repository using SSH, the following error is encountered: ```plaintext git@192.168.101.6: Permission denied (publickey,password). fatal: Could not read from remote repository. ``` ### Request for Assistance I have seen at least four users ask about this problem, but I have not seen a clear resolution. Can someone confirm they can set up Gitea from scratch on a headless `debian-12-standard LXC container via ssh with the following requirements: 1. **SSH Access** : 2. **HTTP Access** : 3. **User Configuration** : 4. **Verification** : I would appreciate confirmation that this setup can be successfully completed by following the steps a first-time user would take. Form a clean operating system. Any insights or common pitfalls to avoid would be helpful. Thank you! As fellow sufferers have noted there do not seem to be instructions for installing gitea coexisting with system cli access via ssh. Everyone I’ve seen asking this question has given up. ---
**Author:** ![linkp](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/linkp/32/4833_2.png) [@linkp](https://forum.gitea.com/u/linkp)\ **Post date:** [July 26, 2024, 1:05pm UTC](https://forum.gitea.com/t/separating-the-gitea-and-system-ssh-servers/9506/2 "2024-07-26T13:05:34Z")
Why even complicate things with the Gitea SSH? Gitea works fine using the system SSH on the default port. Other than adding unnecessary complications, what do you hope to gain by running another SSH daemon? ---
**Author:** ![pjgoodall](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/pjgoodall/32/2967_2.png) [@pjgoodall](https://forum.gitea.com/u/pjgoodall)\ **Post date:** [July 26, 2024, 11:39pm UTC](https://forum.gitea.com/t/separating-the-gitea-and-system-ssh-servers/9506/3 "2024-07-26T23:39:11Z")
If I launch a Debian container on Proxmox, it has `sshd` running by default. When I install Gitea on it, my understanding (which is limited due to the lack of tutorials or documentation i can find on this topic) is that Gitea installs another ssh service that conflicts with the original `sshd`. I’ve seen four posts attempting to solve this problem, but none provided a complete answer. Answers when discussing - don’t seem to distinguish between the two ssh services when discussing solutions, which doesn’t cure any confusion AFAIK I didn’t install another ssh service. Here is one of the easier to follow discussions: [gitea: Built-in ssh server not starting when sshd server running](https://stackoverflow.com/questions/69688288/gitea-built-in-ssh-server-not-starting-when-sshd-server-running) I’ve tried True and False ```auto [server] START_SSH_SERVER = ``` I prefer to have cli access via ssh - access via ansible, system updates etc. i tried moving builtin sshd to Port 222 - still failed. Most answers to this class of problem have not taken it seriously. ---
**Author:** ![linkp](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/linkp/32/4833_2.png) [@linkp](https://forum.gitea.com/u/linkp)\ **Post date:** [July 26, 2024, 11:52pm UTC](https://forum.gitea.com/t/separating-the-gitea-and-system-ssh-servers/9506/4 "2024-07-26T23:52:10Z")
I appreciate the additional explanation. It has raised my intrigue. Time permitting, if I am able to attempt to recreate the scenario, I will share my findings. ---
**Author:** ![viyefi8284](https://avatars.discourse-cdn.com/v4/letter/v/edb3f5/32.png) [@viyefi8284](https://forum.gitea.com/u/viyefi8284)\ **Post date:** [August 4, 2024, 6:38am UTC](https://forum.gitea.com/t/separating-the-gitea-and-system-ssh-servers/9506/5 "2024-08-04T06:38:00Z")
I came across this post as I was experiencing a very similar problem to you (couldn’t use ssh with gitea) and I had almost exactly the same setup _except_ that I had not touched the default sshd setup. specifically, i setup gitea in a proxmox LXC container using the script at [Proxmox VE Helper-Scripts](https://tteck.github.io/Proxmox/) (search gitea). the script from tteck is very new (it was only added on 26 July) and I guess as such may still contain unidentified bugs… the timing of your post makes me wonder if you used the tteck script as well? (in debugging my problem I subsequently believe the tteck script is based off [Gitea: Easy Self-Hosted Git Repositories! :: apalrd's adventures](https://www.apalrd.net/posts/2023/ultimate_gitea/)) anyway, using the auto installation script I setup gitea on a Debian 12 system in an unprivileged LXC container. it all seemed to work no issue and I could interact with the web gui. as testing, i created a test repo (in the gui) and could clone through http but NOT ssh… after a couple of hours playing around I finally identified my issues… there was 2. basically ssh was looking for the authorized\_keys file in the defined home directory for the gitea user created by the installation script - specifically at /etc/gitea. The .ssh/authorized\_keys file did not exist there, rather it existed at /var/lib/gitea/data/.ssh/authorized\_keys. To ‘counter’ this problem I symlinked the actual directory to the one sshd was looking for: `sudo -u gitea ln -s /var/lib/gitea/data/.ssh/ /etc/gitea/.ssh`. This appeared to work as I started getting a different error. A quick bit of googling suggested this new error was the result of the gitea user not being setup with a shell (the installation script sets it up with `/usr/sbin/nologin`). I gave the gitea user a shell, `chsh -s /usr/bin/bash gitea`, tried a git clone again with SSH and it all worked! I’m not sure if this will fix your problem or if it is related at all but hopefully it helps. The key thing for me in debugging this issue was enabling verbose sshd logging by setting `LogLevel DEBUG3` in my sshd\_config and following /var/log/auth.log which ultimately showed me where sshd was looking for keys for the gitea user… and that it was the wrong location. good luck! ---
**Author:** ![pjgoodall](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/pjgoodall/32/2967_2.png) [@pjgoodall](https://forum.gitea.com/u/pjgoodall)\ **Post date:** [August 13, 2024, 1:32am UTC](https://forum.gitea.com/t/separating-the-gitea-and-system-ssh-servers/9506/6 "2024-08-13T01:32:07Z")
Update: I tried this a week ago hoping it would help. Haven’t had time to post. I started from a clean Debian container - as above. Because the container console is a tty, I could mask the ssh service before I installed gitea. This should avoid two ssh services ### Mask ssh service ```auto apt upgrade sudo systemctl stop ssh sudo systemctl disable ssh sudo systemctl mask ssh shutdown ``` All logins seem to be working on port 22. I took a snapshot here. Then continued the install Reconfigured the system ```auto ❯ git clone gitea@teapot:/test-teapot.git Cloning into 'test-teapot'... gitea@192.168.101.6: Permission denied (publickey,password). fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. ``` ```auto ❯ git clone http://teapot//test-teapot.git Cloning into 'test-teapot'... remote: Enumerating objects: 4, done. remote: Counting objects: 100% (4/4), done. remote: Compressing objects: 100% (4/4), done. remote: Total 4 (delta 0), reused 0 (delta 0), pack-reused 0 Receiving objects: 100% (4/4), done. ``` I’ll try people’s other suggestions next - especially the logging and giving the gitea user a shell. I wanted to make the ssh service simple first. ---
**Author:** ![pjgoodall](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/pjgoodall/32/2967_2.png) [@pjgoodall](https://forum.gitea.com/u/pjgoodall)\ **Post date:** [August 15, 2024, 12:39am UTC](https://forum.gitea.com/t/separating-the-gitea-and-system-ssh-servers/9506/7 "2024-08-15T00:39:12Z")
> [@viyefi8284](#): > > chsh -s /usr/bin/bash gitea I tried duplicating exactly your process - including creating and installing using the script. Unchanged error for me. ```auto ❯ git clone gitea@192.168.101.5:/test-gitea.git Cloning into 'test-gitea'... No ED25519 host key is known for 192.168.101.5 and you have requested strict checking. Host key verification failed. fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists ``` http clone works. I installed and verified a key for the user. _Why is it every time i try to set up a tool ‘to make my life easier’ it costs me days and days._ 🙂 Thanks everyone for your time. I’m going to have to find a different solution. ---
**Author:** ![pjgoodall](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/pjgoodall/32/2967_2.png) [@pjgoodall](https://forum.gitea.com/u/pjgoodall)\ **Post date:** [August 18, 2024, 7:18am UTC](https://forum.gitea.com/t/separating-the-gitea-and-system-ssh-servers/9506/8 "2024-08-18T07:18:46Z")
**Success!** Thanks again for your help. I had one other problem - my ssh-server package needed to be updated. I wasn’t seeing ssh listening on port 22 - even though journalctl and the service all reported well. ```bash #as root on proxmox Debian bookworm container console apt update apt full-upgrade apt remove --purge openssh-server apt install openssh-server #Shows it listening on port 22 ss -tuln4 | grep :22 chsh -s /usr/bin/bash gitea, su -c "ln -s /var/lib/gitea/data/.ssh/ /etc/gitea/.ssh" gitea ``` After I gave the gitea user a bash shell and linked the .ssh directory as you suggested It worked!