search

maxgoedjen / secretive

Store SSH keys in the Secure Enclave
MIT License
7.24k stars 159 forks source link

Fails to work on non-GitHub ssh servers #247

Closed QuinnyPig closed 3 years ago

QuinnyPig commented 3 years ago

Seeing this behaviour on several systems (various OSes / sshd versions); it does authenticate to Github properly.

debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: ecdsa-sha2-nistp256 ECDSA SHA256:Gzpp0<secretive key> agent
debug1: Authentications that can continue: publickey

Note that on non-github systems it never prompts me to unlock the secure enclave. How do I troubleshoot this further?

maxgoedjen commented 3 years ago

That's pretty weird... I can't vouch for it working for EVERY ssh server but I've definitely used it personally beyond GitHub (in particular I pretty regularly ssh into other Macs without issue). Lemme think about that one.

QuinnyPig commented 3 years ago

Yeah, I'm wondering if it's something specific to my configuration. I've moved aside my usual global ssh host configuration as a test, but no change. This is what I normally use:

Host *
    ServerAliveInterval 60
    TCPKeepAlive no
    ServerAliveCountMax 10
    StrictHostKeyChecking no
    ConnectTimeout 50
    HashKnownHosts no
    GSSAPIAuthentication no
    ForwardAgent yes
    AddKeysToAgent yes
    IdentityAgent /Users/cquinn/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
maxgoedjen commented 3 years ago

@QuinnyPig thanks, that's helpful. Don't suppose you have a test server you'd be able to let me knock on by any chance? Happy to take this to DM if that's the case to share details.

QuinnyPig commented 3 years ago

Yes. I just set up a node for you and... solved my own problem. The key wasn't appending properly to the authorized_keys file because I am a dangerous fool who shouldn't be allowed near computers. My apologies for this.

maxgoedjen commented 3 years ago

😂 hey who among us. Glad you figured it out, thanks for following up.

QuinnyPig commented 3 years ago

No, thank you for building this. It's referenced as the tool of the week (and in the subject line even!) of tomorrow's "Last Week in AWS Security" newsletter (lastweekinaws.com if you're fortunate enough to not be familiar with my absurd nonsense)