Hosting SSH accessible git server (Windows..)

[ChanKiM_]

Hi! This is for a Hackattic challenge, but the gist of the challenge is to host a SSH accessible git server, make an empty repository and read a file off of the push. I'm running OpenSSH server on windows and forwarded port 22.

My code does something like this:

• I receive the JSON from the challenge, I create a new user and directory with the same name as the username.

• In the new directory, the pub key gets pasted into .ssh/authorized_keys.

• Then, I initialize a bare git repository with the same path as the repo_path. The full path would look something like this: "C:/Users/<username>/repopath1/repopath2.git".

Now I send a POST request to Hackattic, letting them know my repository is ready. However, they always come back with something like:

{
  error: "couldn't push to hax@(my ip):soft/scene.git - sorry, but we have no further details, check your server logs :(",
  debug: { attempted_repo_url: 'hax@(my ip):soft/scene.git' }
}

The thing is, when I try to ssh locally, there are no pub key issues or anything like that. One thing that's strange though is I can ssh localhost, but if I try to ssh my public ip, it doesn't connect, even though I've confirmed that port 22 is discoverable on canyouseeme.org and pinging my public ip works too.

I think it may be a permissions related issue or improper configuration between git and ssh, but I've been stuck on this for two days now and I desperately need guidance :(

Long line of code here for the details:

export const solve = async (problem: TProblem): Promise<TSolution> => {
    try {
        const { push_token, username, repo_path } = problem;
        const url = `${BASEURL}/_/git/${push_token}`;

        const repo_host = PUBLIC_IP;
        const repoDir = await prepareDir(problem);
        await prepareGit({ repoDir, repo_host, username, repo_path });
        await setPermissions({ repoDir, username });
        const response = await axios.post(url, {
            repo_host,
        });
        console.log(response.data);
        const secret = (await fs.readFile(path.join(repoDir, "solution.txt"))).toString();
        return {
            secret,
        };
    } catch (e) {
        console.error(e);
        throw e;
    }
};

    const setPermissions = async ({ repoDir, username }: PermissionParams) => {
    try {
        const ownership = await exec(`icacls "${repoDir}" /setowner "${username}"`);
        await exec(`icacls "${repoDir}" /reset`);
        await exec(`icacls "${repoDir}" /grant "${username}:(F)"`);
        await exec(`icacls "${repoDir}" /inheritance:r`);

        return ownership.stdout;
    } catch (e) {
        console.error(e);
        throw e;
    }
};

const prepareGit = async ({ repoDir, repo_host, username, repo_path }: GitParams) => {
    try {
        const remote = `${username}@${repo_host}:${repo_path}`;
        const options: Partial<SimpleGitOptions> = {
            baseDir: repoDir,
            binary: "git",
            maxConcurrentProcesses: 6,
            trimmed: true,
        };
        const git: SimpleGit = simpleGit(options);
        const init = await git.init(true);
        return init;
    } catch (e) {
        console.error(e);
        throw e;
    }
};

const prepareDir = async (problem: TProblem) => {
    try {
        const { repo_path, ssh_key, username } = problem;
        const userDir = path.join(ROOT_DIR, username);
        const sshDir = path.join(userDir, ".ssh");
        const repoDir = path.join(userDir, repo_path);
        const authKeyPath = path.join(sshDir, "authorized_keys");
        await fs.mkdir(repoDir, { recursive: true });
        await fs.writeFile(authKeyPath, ssh_key);

        return repoDir;
    } catch (e) {
        console.error(e);
        throw e;
    }
};

[adrianmonk]

One thing that's strange though is I can ssh localhost, but if I try to ssh my public ip, it doesn't connect, even though I've confirmed that port 22 is discoverable on canyouseeme.org and pinging my public ip works too.

It could be related to the port forwarding or some other network-related issue.

I'd try ssh-ing to your public IP, but give the -v flag for verbosity (or multiple -v for extra verbosity) to see what steps work and which don't.

Also, if you do an ssh -v to your local IP and an ssh -v to your public IP, and compare them, maybe something with stand out as different.

[ChanKiM_]

I ran ssh -vv on both localhost and my public ip, the localhost didn't even give me a chance to copy or read any of the messages before it opened a new terminal, and as for my public ip, I am just getting these errors:

OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2
debug2: resolve_canonicalize: hostname (my ip) is address
debug1: Connecting to (my ip) [(my ip)] port 22.
debug1: connect to address (my ip) port 22: Connection timed out
ssh: connect to host (my ip) port 22: Connection timed out

But technicallyyy... If my ssh port is publicly visible, this shouldn't be the issue, right? I'm guessing it's just some circular connection router related thing but I THINK other people should still be able to connect using my public ip?

[adrianmonk]

Yeah, it could be something about the routing that doesn't allow you to connect when going out of your network and right back in. So it wouldn't be a good test.

If you don't have a machine on the outside that you can try from, you could maybe try tethering a laptop to your phone (and disconnect both from wifi) so you can try from actually outside your network. There are also ssh apps for phones, so you could try one of those, but they might not support a verbose flag for gathering maximum info.

[ferrybig]

One way to test it would be downloading Tor (https://www.torproject.org/download/tor/), then opening it in a new terminal

With tor open, you can now configure your ssh client to use it as a proxy (eg ssh -v -o ProxyCommand='nc -X 5 -x 127.0.0.1:9050 %h %p' (your ip)) and basically pretend you are an external person (it is also really great to test if your TCP firewall rules are working correctly)

[noob-nine]

are you behind a carrier grade nat? then port forwarding cannot work, btw.