GitHub Deploy Keys and port 443
GitHub deploy keys, are single RSA key pairs locked to a single GitHub repository. It’s much better for security than using an account wide RSA pair. RSA key pairs in turn are what’s used for creating secure SSH sessions and interacting with Git for private repositories.
You may find yourself in a scenario where you need to use multiple private Git repositories in addition to only having certain ports open outbound! The GitHub docs won’t help much if you’re looking for specific examples.
Git uses by default TCP 9418, but it can use 22 and 443 too.
This scenario comes up from time to time when outbound ports are severely limited, leaving you with TCP 443, UDP 53 and a handful of others. The challenge is doing a git clone or git pull on remote repositories with deploy tokens on a port other than 22 or 9418, i.e. 443. Here’s one way of doing that.
- Create an RSA key for each repository you wish to interact with using git.
$ ssh-keygen -t rsa -b 4096 # Name it something specific when it asks and don't set a passphrase
- Load each public key to the git repository deploy keys section (under settings).
- On your server/container/whatever, create a
configfile located at
This file contains some basic SSH aliases and a reference to a specific identity file/key to use.
# The line below is the ssh alias reference (note, not domain) # You can use this alias with a git remote command Host ssh.github.com-alias-1 HostName ssh.github.com User git # Line below is the specific key IdentityFile /home/user/.ssh/github_repo1.id_rsa IdentitiesOnly yes Host ssh.github.com-alias-2 HostName ssh.github.com User git IdentityFile /home/user/.ssh/github_repo2.id_rsa IdentitiesOnly yes
- Try logging into github with this:
ssh -T -p 443 [email protected]
If your token has been loaded correctly and you’re targeting the right repository, you should be able to verify your authentication capability! You won’t get a terminals session, but you will get a friendly message like below.
$ ssh -T -p 443 [email protected] Hi davedotdev/repo-1! You've successfully authenticated, but GitHub does not provide shell access
- Now the bit you’ve been waiting for. If you’ve created deployment keys for
alias-2as an example, you can then try doing a git clone for each repo using their specific deployment keys. This is how to do a git clone for private repositories over port 443 on a limited system (because security told you no!).
git clone ssh://[email protected]:443/YOURACCOUNT/YOURREPO-1.git git clone ssh://[email protected]:443/YOURACCOUNT/YOURREPO-2.git
So, there you have it. Separate GitHub deploy tokens for private repository interaction over HTTPS.
- Tags: devops
- Categories: devops