Fixing the Heroku "Too many authentication failures for git" problem

Posted by Luke Francl
on Sunday, January 31

Getting an error like this when you push to Heroku?

electricsheep:herokuapp look$ git push heroku master
Received disconnect from 75.101.163.44: 2: Too many authentication failures for git
fatal: The remote end hung up unexpectedly

If you like to create an ssh key for each server you use, you run this risk.

The reason is that unless you specify which key to use for a host, ssh-agent sends each key in turn until one works. However some server configure sshd to reject connections after too many attempted logins. For example, Dreamhost does this (see Dealing with SSH’s key spam problem for details). This is especially annoying if you weren’t even planning to use key-based authentication (as is the case on Heroku).

You can fix this by setting IdentitiesOnly yes in your ~/.ssh/config file. You can do this on a host-by-host basis.

host foobar.dreamhost.com        
        IdentitiesOnly yes

Heroku is a bit difficult to do this for because they don’t have a single IP address or domain (that I know of) you can configure this for.

As a workaround, clear your identities:

ssh-add -D

(Thanks to my friend McClain for his help with the ssh-add command.)

Comments

Leave a response

  1. BetelgeuseFebruary 01, 2010 @ 02:43 AM

    ssh config accepts wildcards for the Host line.

  2. FredericFebruary 01, 2010 @ 05:10 AM

    Instead of running “ssh-add -D” before executing the git command, you can simply unset the SSH_AUTH_SOCK environment variable so that the ssh-agent cannot be reached and you won’t have to reload all your identities afterward.

    After unsetting the SSH_AUTH_SOCK variable, you will have to redefine it if you need to execute a command that uses your identies, so you can use a subshell to restrict the unset command to the git command:
    • Bourne-like shells: (unset SSH_AUTH_SOCK; your-git-command)
    • C-like shells : ( unsetenv SSH_AUTH_SOCK; your-git-command )

    When using bash, a shortcut is to simply prepend a “SSH_AUTH_SOCK= ” before the command (no semicolumn): SSH_AUTH_SOCK= your-git-command

  3. Luke FranclFebruary 01, 2010 @ 11:08 AM

    Looking at the Heroku gem’s help output, there’s key management. I don’t see it on their web app.

    I wonder if this would fix it.

    heroku keys

    heroku keys:add

    heroku keys:remove

    heroku keys:clear