0

I use my yubikey to authenticate against remote hosts with ssh. This works (with the same keys) on Linux, and it fails on Windows, with git-bash.

all this is on windows 10, and this is OpenSSH_9.0p1, OpenSSL 1.1.1p 21 Jun 2022

This is the error message. Why does the signing fail?

debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /c/Users/Andreas/.ssh/id_ohnering_sk ED25519-SK SHA256:C2BdL8/gLMbP6ktTI/Z22+FhZ51VbPhvxnto7GYxkj4 explicit authenticator agent
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: /c/Users/Andreas/.ssh/id_ohnering_sk ED25519-SK SHA256:C2BdL8/gLMbP6ktTI/Z22+FhZ51VbPhvxnto7GYxkj4 explicit authenticator agent
sign_and_send_pubkey: signing failed for ED25519-SK "/c/Users/Andreas/.ssh/id_ohnering_sk" from agent: agent refused operation
debug1: Offering public key: /c/Users/Andreas/.ssh/id_ring_sk ED25519-SK SHA256:chjSSXPpiBHI+0MnO8v51yC8632tKr358BPGUubkrto explicit authenticator agent
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: /c/Users/Andreas/.ssh/id_ring_sk ED25519-SK SHA256:chjSSXPpiBHI+0MnO8v51yC8632tKr358BPGUubkrto explicit authenticator agent
sign_and_send_pubkey: signing failed for ED25519-SK "/c/Users/Andreas/.ssh/id_ring_sk" from agent: agent refused operation
debug1: Offering public key: /c/Users/Andreas/.ssh/id_rsa RSA SHA256:5sI4OvJOs6+7RcD76iomtR6geCSBoZ5397jeWzNlspE agent
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
aschuld@ssh.blah: Permission denied (publickey).

The agent has the keys

ssh-add -l
4096 SHA256:5sI4OvJOs6+7RcD76iomtR6geCSBoZ5397jeWzNlspE /c/Users/andreas/.ssh/id_rsa (RSA)
256 SHA256:C2BdL8/gLMbP6ktTI/Z22+FhZ51VbPhvxnto7GYxkj4 andreas@salomon (ED25519-SK)
256 SHA256:chjSSXPpiBHI+0MnO8v51yC8632tKr358BPGUubkrto andreas@salomon (ED25519-SK)

here are the permissions of my keys (on windows)

ls -al .ssh
total 85
drwxr-xr-x 1 Andreas 197121 0 Jul 7 16:24 ./
drwxr-xr-x 1 Andreas 197121 0 Jul 7 16:27 ../
-rw-r--r-- 1 Andreas 197121 1471 Jun 17 13:46 config
-rw-r--r-- 1 Andreas 197121 407 Jul 6 2021 id_mykey_sk
-rw-r--r-- 1 Andreas 197121 144 Jul 6 2021 id_mykey_sk.pub
-rw-r--r-- 1 Andreas 197121 561 Jun 17 13:33 id_ohnering_sk
-rw-r--r-- 1 Andreas 197121 144 Jun 17 13:33 id_ohnering_sk.pub
-rw-r--r-- 1 Andreas 197121 561 Jun 17 13:33 id_ring_sk
-rw-r--r-- 1 Andreas 197121 144 Jun 17 13:33 id_ring_sk.pub
-rw-r--r-- 1 Andreas 197121 4583 May 17 13:50 known_hosts

Obviously those permissions would not be sufficient on linux. Are they ok on windows? I seem to be unable to set them to 600. I dont think that is the issue, though.

What is going on here? how do i get it to work?

Andreas Schuldei
  • 143
  • 7
  • Was your Cygwin OpenSSH in fact built with libfido support? (The native Win32-OpenSSH builds got SK support via Windows Hello fairly recently so you might want to use that instead.) – user1686 Jul 08 '22 at 08:29
  • I don't use Cygwin, but git-bash. it contains a fully operational openssh client implementation – Andreas Schuldei Jul 08 '22 at 12:43

1 Answers1

0

it seems this was a problem with a combination of needing to run git-bash as administrator, so it could access the USB device. (Even the original yubikey tools needed to be run as administrator, to be accessible.) the second issue was an old winhello.dll in the lib path. I removed it. Then I was able to generate a new ED25519_SK key on windows, and with that one I am able to authenticate.

Andreas Schuldei
  • 143
  • 7