LedgerHQ / app-ssh-agent

Simple SSH and GPG agent for Ledger Blue and Nano S
Apache License 2.0
78 stars 27 forks source link

handle errors better, remove stacktrace from the users perspective. #36

Open mathieujobin opened 1 year ago

mathieujobin commented 1 year ago

I am following this procedure from the ledger blog.

https://blog.ledger.com/ssh/

First, I am surprised to find out the ledger_agent and the trezor_agent is under one umbrella?

I get many errors from the command line tool.

the doc says I can provide the key file with $HOME but it crash, although it works with ~/

$ ledger-agent "$HOME/.ssh/nanox-keys.conf.pub" -s -v
Traceback (most recent call last):
  File "/home/mathieu/.local/bin/ledger-agent", line 8, in <module>
    sys.exit(ssh_agent())
  File "/home/mathieu/.local/bin/ledger_agent.py", line 5, in <lambda>
    ssh_agent = lambda: libagent.ssh.main(DeviceType)
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/ssh/__init__.py", line 173, in wrapper
    return func(*args, **kwargs)
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/ssh/__init__.py", line 266, in main
    public_keys = list(import_public_keys(contents))
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/ssh/__init__.py", line 191, in import_public_keys
    formats.import_public_key(line)
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/formats.py", line 219, in import_public_key
    file_type, base64blob, name = line.split()
ValueError: not enough values to unpack (expected 3, got 1)

versus

ledger-agent "~/.ssh/nanox-keys.pub" -s -v
2022-11-08 13:04:50,497 INFO         identity #0: <ssh://~/.ssh/nanox-keys.pub|nist256p1>                                                 [__init__.py:273]
2022-11-08 13:04:50,506 INFO         using [b'ttyname=/dev/pts/1', b'display=:0'] for pinentry options                                    [ui.py:94]
2022-11-08 13:04:50,516 INFO         running '/bin/bash' with {'SSH_AUTH_SOCK': '/tmp/trezor-ssh-agent-tapc16t8', 'SSH_AGENT_PID': '835975'} [server.py:156]

next when trying to connect. this one is better handled, we can read obvious message, but could still appear cryptic to many users.

$ ssh luna
2022-11-08 13:04:59,522 WARNING      error: LedgerNanoS not connected: "Exception : No dongle found"                                      [server.py:100]
Traceback (most recent call last):
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/device/ledger.py", line 48, in connect
    return comm.getDongle()
  File "/home/mathieu/.local/lib/python3.10/site-packages/ledgerblue/comm.py", line 240, in getDongle
    raise CommException("No dongle found")
ledgerblue.commException.CommException: Exception : No dongle found

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/server.py", line 95, in handle_connection
    reply = handler.handle(msg=msg)
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/ssh/protocol.py", line 106, in handle
    reply = method(buf=buf)
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/ssh/protocol.py", line 114, in list_pubs
    keys = self.conn.parse_public_keys()
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/ssh/__init__.py", line 215, in parse_public_keys
    for pk in self.public_keys()]
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/ssh/__init__.py", line 209, in public_keys
    self.public_keys_cache = conn.export_public_keys(self.identities)
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/ssh/client.py", line 24, in export_public_keys
    with self.device:
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/device/interface.py", line 126, in __enter__
    self.conn = self.connect()
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/device/ledger.py", line 50, in connect
    raise interface.NotFoundError(
libagent.device.interface.NotFoundError: LedgerNanoS not connected: "Exception : No dongle found"

when I connect my ledger and open the SSH app, it still does not work. I get this message

2022-11-08 13:06:27,369 WARNING      Unsupported command: SSH2_AGENTC_ADD_IDENTITY (17)                                                   [protocol.py:101]

and finally, ssh-add -l simply listing keys to my agent, will also spit a backtrace unless ledger is unlocked

$ ssh-add -l
error fetching identities: communication with agent failed
2022-11-08 13:18:53,693 WARNING      error: Exception : Invalid status 6b0c (Unknown reason)                                              [server.py:100]
Traceback (most recent call last):
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/server.py", line 95, in handle_connection
    reply = handler.handle(msg=msg)
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/ssh/protocol.py", line 106, in handle
    reply = method(buf=buf)
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/ssh/protocol.py", line 114, in list_pubs
    keys = self.conn.parse_public_keys()
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/ssh/__init__.py", line 215, in parse_public_keys
    for pk in self.public_keys()]
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/ssh/__init__.py", line 209, in public_keys
    self.public_keys_cache = conn.export_public_keys(self.identities)
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/ssh/client.py", line 26, in export_public_keys
    vk = self.device.pubkey(identity=i)
  File "/home/mathieu/.local/lib/python3.10/site-packages/libagent/device/ledger.py", line 66, in pubkey
    result = bytearray(self.conn.exchange(bytes(apdu)))
  File "/home/mathieu/.local/lib/python3.10/site-packages/ledgerblue/comm.py", line 145, in exchange
    raise CommException("Invalid status %04x (%s)" % (sw, possibleCause), sw, response)
ledgerblue.commException.CommException: Exception : Invalid status 6b0c (Unknown reason)

$ ssh-add -l
256 SHA256:wmDL0AU3FUhjwi4md8cY2WDSIH0AzxsSmrHVU3lwuA0 <ssh://~/.ssh/nanox-keys.conf.pub|nist256p1> (ECDSA)