[Bug 1812247] Re: ssh-askpass(-gnome) fails for ssh-add -c: agent refused operation

[Ulrich Schwarz]

My suspicion is that we never get as far as askpass – gnome-keyring-
daemon spawns a ssh-agent to pass requests on to (in my case, that's
easy to spot because I use PKCS#11 tokens and that's the one spawning
ssh-pkcs11-helpers), and that one doesn't have DISPLAY in its
environment, so it won't even try to obtain permission that way.

I'll see if I have enough foo to either force the ssh agents into debug
mode (readpass.c's read_passphrase() only logs at debug level) or
frobnicate their environment to have a DISPLAY, see if that fixes
things.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1812247

Title:
  ssh-askpass(-gnome) fails for ssh-add -c: agent refused operation

Status in gnome-keyring package in Ubuntu:
  Confirmed
Status in openssh package in Ubuntu:
  Invalid

Bug description:
  Ubuntu uses ssh-agent from OpenSSH which supports adding keys by means
  of `ssh-add -c` indicating that keys "should be subject to
  confirmation before being used for authentication. In Ubuntu 18.10
  this fails with the error

    sign_and_send_pubkey: signing failed: agent refused operation

  To reproduce I used a Ubuntu 18.10 Live "CD", apt-get update && apt-
  get upgrade, log out and log back in (these steps are not required but
  we want to use an up-to-date system). Then:

  $ sudo apt-get install ssh-askpass-gnome
  (...)
  $ # verify that ssh-askpass shows a popup, confirm with Enter
  $ ssh-askpass ; echo $?

  0
  $ ssh-keygen
  (...)
  $ ssh-add -D
  All identities removed.
  $ ssh-copy-id $sshuser@$sshserver
  (...)
  Number of key(s) added: 1
  (...)
  $ ssh $sshuser@$sshserver uname -a
  Linux server 4.9.0-8-amd64 #1 SMP Debian 4.9.130-2 (2018-10-27) x86_64 GNU/Linux
  $ ssh-add -d
  Identity removed: /home/ubuntu/.ssh/id_rsa (ubuntu at ubuntu)
  $ ssh-add -c
  Enter passphrase for /home/ubuntu/.ssh/id_rsa (will confirm each use): 
  Identity added: /home/ubuntu/.ssh/id_rsa (/home/ubuntu/.ssh/id_rsa)
  The user must confirm each use of the key
  $ ssh $sshuser@$sshserver uname -a
  sign_and_send_pubkey: signing failed: agent refused operation
  sshuser at server's password: [^C'ed]

  $ ssh-add -l
  2048 SHA256:yvAFsTpkNWnlrQyCp+tWV83dIF8Je3AksM0o+Ajvyyc /home/ubuntu/.ssh/id_rsa (RSA)

  So, our key is loaded, ssh-askpass is working (also confirmed with
  `ssh-add -c </dev/null`), but authentication fails with
  "sign_and_send_pubkey: signing failed: agent refused operation".

  ProblemType: Bug
  DistroRelease: Ubuntu 18.10
  Package: gnome-session-bin 3.30.0-0ubuntu4
  ProcVersionSignature: Ubuntu 4.18.0-10.11-generic 4.18.12
  Uname: Linux 4.18.0-10-generic x86_64
  ApportVersion: 2.20.10-0ubuntu13.1
  Architecture: amd64
  CasperVersion: 1.399
  CurrentDesktop: ubuntu:GNOME
  Date: Thu Jan 17 17:14:35 2019
  ExecutablePath: /usr/lib/gnome-session/gnome-session-binary
  LiveMediaBuild: Ubuntu 18.10 "Cosmic Cuttlefish" - Release amd64 (20181017.3)
  ProcEnviron:
   PATH=(custom, no user)
   XDG_RUNTIME_DIR=<set>
   LANG=C.UTF-8
   SHELL=/bin/bash
  SourcePackage: gnome-session
  UpgradeStatus: No upgrade log present (probably fresh install)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1812247/+subscriptions