git clone works; git submodule fails "Permission denied"

The answer from lukas-reineke correctly describes the problem and a possible solution using ssh-agent to enable cloning of git submodules that are configured such that they should be cloned over ssh instead of https.

As an alternative to using ssh-agent you could use putty's pageant. That way you can configure the host where the git repository lies as saved session in putty, and then clone the submodule with:

set GIT_SSH=plink & git submodule update

Of course you have to make sure that plink.exe can actually be found in your %PATH%, and that you have added your private key to the running pageant instance (there should be a little systray icon that you can click to 'Add Keys').

Since ssh-agent can be a little tricky to get running correctly from the native cmd.exe of windows, I found this alternative method quite helpful.

You can also just change your ssh key to one that does not need a passphrase. I had same issue and now git submodule update --init --recursive works fine after using no passphrase.

It seems to be a bug in Windows git that when it updates a submodule, it does not ask for the paraphrase key. (git version 2.19.1.windows.1)

Git tries to clone the submodule using ssh and not https. If you haven't configured your ssh key this will fail.
You can setup ssh-agent to cache the password for the ssh key and get git to use that. Or change to https.
Git is a bit confusing regarding submodules. They are configured in the .gitmodules file in the directory, but changing the url here from ssh to https won't help. Git uses the url that is configured in .git/config.
Open this file and you will find something like this.

[submodule "project-submodule"]
    url = [email protected]:project-submodule.git

Change this url to the https equivalent and try again.

The problem seems to be OpenSSH 3.8 throws up a dialog box that isn't accessible from win32?

If you switch to Git Bash (installed by default with git), then the dialog box pops up and you can enter your private key passcode.

As others have pointed out, the alternative is to use putty and set up plink to work with ssh. I usually use that method and it works flawlessly with pageant. The tricky part is setting up plink: https://makandracards.com/makandra/1303-how-to-use-git-on-windows-with-putty

*Update: I tried putty/pageant and couldn't make it work. The options passed by the jenkins git addon aren't compatible with pageant.

Finding the dialog box doesn't help with my Jenkins setup though...