search

cockpit-project / cockpit

Cockpit is a web-based graphical interface for servers.
http://www.cockpit-project.org/
GNU Lesser General Public License v2.1
11.01k stars 1.1k forks source link

SSH FIDO key types do not work (ecdsa-sk and ed25519-sk) #17136

Open Tomaszal opened 2 years ago

Tomaszal commented 2 years ago

Explain what happens

  1. Log into Cockpit
  2. Go to add an SSH key
  3. Select an SSH key of type ecdsa-sk or ed25519-sk
  4. Click Add
  5. Nothing happens

Version of Cockpit

264

Where is the problem in Cockpit?

Accounts

Server operating system

Arch Linux

Server operating system version

No response

What browsers are you using?

Firefox

System log

No response

martinpitt commented 1 year ago

This sounds like a limitation of libssh, the SSH library that cockpit-ssh uses. It's worth trying with the most recent version, we recently got libssh 0.10 in Fedora, Debian testing, and hopefully also Arch.

We are currently working on rewriting cockpit-ssh around the standard ssh(1) program, which will fix such issues in general.

proninyaroslav commented 2 months ago

It's worth trying with the most recent version, we recently got libssh 0.10 in Fedora, Debian testing, and hopefully also Arch.

This also doesn't work so far on version 0.10.6 (Fedora Server 40)

proninyaroslav commented 2 months ago

@martinpitt Are there any plans to add support for ed25519-sk and at what stage of its implementation?

martinpitt commented 2 months ago

@proninyaroslav It should already work with the "Add host" functionality in a running cockpit session. That already uses standard ssh(1), not cockpit-ssh.

proninyaroslav commented 2 months ago

@martinpitt When I try to "Add host" the server on which cockpit is installed and authorize the ssh key, it says authorization error, or hangs on authorization when adding a host.

P.S: As I understand it, this requires me to insert a hardware token into the server, but I need authorization on the client and the token is inserted on the client machine, so how does this work with the CLI SSH when I enter the host and touch the token for authorization.