aaunario-keeper
commented
2 weeks ago Hi,
Unless you're using SSH agent forwarding (it doesn't look like it based on your commands), support for that protocol extension shouldn't be an issue. The current implementation of Commander's SSH agent should at least allow you to connect to a remote host directly from the device running the agent/Commander.
Would you mind providing the output of the following command (feel free to redact sensitive info): ssh -vvv @.*** ?
On Mon, Jun 17, 2024 at 4:55 AM phlibi @.***> wrote:
Hi everyone,
I'm having a hard time getting my SSH to work with keepercommander's ssh-agent. I've added keys and they are properly listed with ssh-add -l. Logging in even works when I first manually extract the public key part using ssh-add -L into a file and then use ssh -i serverkey.pub @., but when using it "normally", like with ssh @., the result is just:
$ ssh @. @.: Permission denied (publickey).
The ssh-agent in this case only logs
SSH Agent has been unlocked
By adding a few (at least 2) -v switches to the SSH invocation, I see this:
debug2: get_agent_identities: ssh_agent_bind_hostkey: agent refused operation debug1: get_agent_identities: agent returned 1 keys
I then added two prints near the beginning of _process_ssh_agent_request() https://github.com/Keeper-Security/Commander/blob/8b7d262374850996e289072c2a09f8f975c82121/keepercommander/commands/ssh_agent.py#L404 to figure out what's going on:
print(f'lock_passphrase={self._lock_passphrase}') print(f'command={command}')Now the agent is slightly more talkative when trying to establish a connection:
lock_passphrase=None command=27 SSH Agent has been unlocked lock_passphrase=None command=11
The offending line is command=27: There is just no branch and not even a definition for this type in the code:
SSH_AGENTC_REQUEST_IDENTITIES = 11SSH_AGENTC_SIGN_REQUEST = 13SSH_AGENTC_ADD_IDENTITY = 17SSH_AGENTC_REMOVE_IDENTITY = 18SSH_AGENTC_REMOVE_ALL_IDENTITIES = 19SSH_AGENTC_LOCK = 22SSH_AGENTC_UNLOCK = 23SSH_AGENTC_ADD_ID_CONSTRAINED = 25 SSH_AGENT_FAILURE = 5SSH_AGENT_SUCCESS = 6SSH_AGENT_IDENTITIES_ANSWER = 12SSH_AGENT_SIGN_RESPONSE = 14 SSH_AGENT_RSA_SHA2_256 = 2SSH_AGENT_RSA_SHA2_512 = 4 SSH_AGENT_CONSTRAIN_LIFETIME = 1
According to an IETF document https://www.ietf.org/archive/id/draft-miller-ssh-agent-08.txt, type 27 is SSH_AGENTC_EXTENSION. This probably refers to the SSH agent restriction https://www.openssh.com/agent-restrict.html protocol extension. This is apparently just not supported yet by keepercommander's ssh-agent.
My ssh version:
$ ssh -V OpenSSH_9.2p1 Debian-2+deb12u2, OpenSSL 3.0.11 19 Sep 2023
Is it correct that the failure is due to this lack of support, or is it just me doing something wrong? In the former case, are there plans to add support for this protocol extension to ssh-agent any time soon? Is there maybe an option to tell SSH not to try this protocol extension and go without it?
Thanks!
— Reply to this email directly, view it on GitHub https://github.com/Keeper-Security/Commander/issues/1251, or unsubscribe https://github.com/notifications/unsubscribe-auth/AZDPG4IOSBQUUNBZRATUHGLZH2XB5AVCNFSM6AAAAABJNVI7ESVHI2DSMVQWIX3LMV43ASLTON2WKOZSGM2TMOJRG4ZTSNQ . You are receiving this because you are subscribed to this thread.Message ID: @.***>
--
Ayrris Aunario | Senior Software Engineer
Mobile 773.986.1194
This email is confidential and is intended for the recipient(s) addressed herein
phlibi
Hi everyone,
I'm having a hard time getting my SSH to work with keepercommander's
ssh-agent. I've added keys and they are properly listed withssh-add -l. Logging in even works when I first manually extract the public key part usingssh-add -Linto a file and then usessh -i serverkey.pub user@host, but when using it "normally", like withssh user@host, the result is just:The ssh-agent in this case only logs
By adding a few (at least 2)
-vswitches to the SSH invocation, I see this:I then added two prints near the beginning of
_process_ssh_agent_request()to figure out what's going on:Now the agent is slightly more talkative when trying to establish a connection:
The offending line is
command=27: There is just no branch and not even a definition for this type in the code:According to an IETF document, type 27 is
SSH_AGENTC_EXTENSION. This probably refers to the SSH agent restriction protocol extension. This is apparently just not supported yet by keepercommander'sssh-agent.My
sshversion:Is it correct that the failure is due to this lack of support, or is it just me doing something wrong? In the former case, are there plans to add support for this protocol extension to
ssh-agentany time soon? Is there maybe an option to tell SSH not to try this protocol extension and go without it?Thanks!