GitHub's SSH Server Now Requires a .pub File – Here's Why

A developer reports that git pull suddenly failed with Permission denied (publickey) on a machine where nothing had changed. The private key was valid, the signature algorithm was rsa-sha2-512, and other machines with different keys worked fine. The culprit? A missing .pub file.

The Debugging Rabbit Hole

The key passed openssl rsa -check, ~/.ssh/config was clean, and GitHub's status page showed green. Yet authentication failed. The fix was generating a public key file from the private key:

$ ssh-keygen -y -f ~/.ssh/github_rsa > ~/.ssh/github_rsa.pub

The author tested this six times with and without the .pub file. Without it: rejected every time. With it: accepted every time.

Why a .pub File Changes Behavior

OpenSSH uses two authentication flows per RFC 4252. With a .pub file present, the client first probes by offering the public key and waiting for the server's acknowledgment before signing. Without a .pub file, OpenSSH skips the probe and sends a fully signed authentication request directly. A standard sshd accepts both — but GitHub's SSH frontend now rejects the direct-signed flow.

Something Changed on GitHub's Side

The server banner in debug logs shows 6a2c000, whereas GitHub's SSH frontend historically used babeld-<hash>. This suggests new server software that no longer accepts the direct-signed publickey method. The timing — working one hour, broken the next — aligns with a server-side deployment.

If you hit this, regenerate your .pub file. And if you know what 6a2c000 is, the community would like to hear.