search

maxgoedjen / secretive

Store SSH keys in the Secure Enclave
MIT License
6.99k stars 155 forks source link

Secretive isn't working #363

Closed ridicolos closed 2 years ago

ridicolos commented 2 years ago

Secretive isn't working for some reason.

I had it installed a while back and there it seems to work. After I ditched the software for some time and now reinstalled it it doesn't work.

I created a new key for GitHub, checked the public-key into my GitHub preferences and gave it a shot. But it doesn't work. I think my ssh-agent completely ignores the secretive installation. Am I missing something here?

I installed secretive with brew install secretive and also tried brew reinstall secretive today. I also restarted my Mac but it doesn't fix the issue.

As mentioned in your FAQ here I provide the log of ssh -Tv git@github.com:

$ ssh -Tv git@github.com
OpenSSH_8.9p1, OpenSSL 1.1.1m  14 Dec 2021
debug1: Reading configuration data /Users/dennis/.ssh/config
debug1: Reading configuration data /opt/homebrew/etc/ssh/ssh_config
debug1: Connecting to github.com [140.82.121.4] port 22.
debug1: Connection established.
debug1: identity file /Users/dennis/.ssh/id_rsa type -1
debug1: identity file /Users/dennis/.ssh/id_rsa-cert type -1
debug1: identity file /Users/dennis/.ssh/id_ecdsa type -1
debug1: identity file /Users/dennis/.ssh/id_ecdsa-cert type -1
debug1: identity file /Users/dennis/.ssh/id_ecdsa_sk type -1
debug1: identity file /Users/dennis/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /Users/dennis/.ssh/id_ed25519 type -1
debug1: identity file /Users/dennis/.ssh/id_ed25519-cert type -1
debug1: identity file /Users/dennis/.ssh/id_ed25519_sk type -1
debug1: identity file /Users/dennis/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /Users/dennis/.ssh/id_xmss type -1
debug1: identity file /Users/dennis/.ssh/id_xmss-cert type -1
debug1: identity file /Users/dennis/.ssh/id_dsa type -1
debug1: identity file /Users/dennis/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.9
debug1: Remote protocol version 2.0, remote software version babeld-0f6ba948
debug1: compat_banner: no match: babeld-0f6ba948
debug1: Authenticating to github.com:22 as 'git'
debug1: load_hostkeys: fopen /Users/dennis/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /opt/homebrew/etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /opt/homebrew/etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: rsa-sha2-512
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-rsa SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8
debug1: load_hostkeys: fopen /Users/dennis/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /opt/homebrew/etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /opt/homebrew/etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host 'github.com' is known and matches the RSA host key.
debug1: Found key in /Users/dennis/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: get_agent_identities: ssh_fetch_identitylist: agent contains no identities
debug1: Will attempt key: /Users/dennis/.ssh/id_rsa
debug1: Will attempt key: /Users/dennis/.ssh/id_ecdsa
debug1: Will attempt key: /Users/dennis/.ssh/id_ecdsa_sk
debug1: Will attempt key: /Users/dennis/.ssh/id_ed25519
debug1: Will attempt key: /Users/dennis/.ssh/id_ed25519_sk
debug1: Will attempt key: /Users/dennis/.ssh/id_xmss
debug1: Will attempt key: /Users/dennis/.ssh/id_dsa
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/dennis/.ssh/id_rsa
debug1: Trying private key: /Users/dennis/.ssh/id_ecdsa
debug1: Trying private key: /Users/dennis/.ssh/id_ecdsa_sk
debug1: Trying private key: /Users/dennis/.ssh/id_ed25519
debug1: Trying private key: /Users/dennis/.ssh/id_ed25519_sk
debug1: Trying private key: /Users/dennis/.ssh/id_xmss
debug1: Trying private key: /Users/dennis/.ssh/id_dsa
debug1: No more authentication methods to try.
git@github.com: Permission denied (publickey).

if you need any additional information please let me know

maxgoedjen commented 2 years ago

@ridicolos can you run the setup flow from help again, and make sure you've got the SSH auth socket set properly (it should walk you through that).

andrewjackman commented 2 years ago

I've got the same problem - been using it since early Jan and it has been great, updated to the latest version on Monday, and now, every day I seem to have to create a new key and add it to GitHub. Just tried to git pull this morning and got:

git@github.com: Permission denied (publickey).

I had the same thing yesterday morning.


debug1: Reading configuration data /Users/andrew/.ssh/config
debug1: /Users/andrew/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: include /etc/ssh/ssh_config.d/* matched no files
debug1: /etc/ssh/ssh_config line 54: Applying options for *
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug1: Connecting to github.com port 22.
debug1: Connection established.
debug1: identity file /Users/andrew/.ssh/id_ed25519 type 3
debug1: identity file /Users/andrew/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.6
debug1: Remote protocol version 2.0, remote software version babeld-0f6ba948
debug1: compat_banner: no match: babeld-0f6ba948
debug1: Authenticating to github.com:22 as 'git'
debug1: load_hostkeys: fopen /Users/andrew/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU
debug1: load_hostkeys: fopen /Users/andrew/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host 'github.com' is known and matches the ED25519 host key.
debug1: Found key in /Users/andrew/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: pubkey_prepare: ssh_get_authentication_socket: Connection refused
debug1: Will attempt key: /Users/andrew/.ssh/id_ed25519 ED25519 SHA256:ZNVlhLvA3IphiEyIbkDc2uOfm4MHOD8/yAkt/rkiCNM explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /Users/andrew/.ssh/id_ed25519 ED25519 SHA256:ZNVlhLvA3IphiEyIbkDc2uOfm4MHOD8/yAkt/rkiCNM explicit
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
git@github.com: Permission denied (publickey).```

I'm on an M1 Mac. I'll try the setup flow too and report back...
andrewjackman commented 2 years ago

Ok, so I just started the Secretive UI and I had to approve it before it would run (thanks Apple), and now it appears to be working once again. But, I haven't updated it since yesterday, so no idea why I needed to approve the app before it would run. One note, I'm on the latest Monterey macOS beta, so maybe something has broken the approval of downloaded apps...

I've got the same problem - been using it since early Jan and it has been great, updated to the latest version on Monday, and now, every day I seem to have to create a new key and add it to GitHub. Just tried to git pull this morning and got:

git@github.com: Permission denied (publickey).

I had the same thing yesterday morning.

debug1: Reading configuration data /Users/andrew/.ssh/config
debug1: /Users/andrew/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: include /etc/ssh/ssh_config.d/* matched no files
debug1: /etc/ssh/ssh_config line 54: Applying options for *
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug1: Connecting to github.com port 22.
debug1: Connection established.
debug1: identity file /Users/andrew/.ssh/id_ed25519 type 3
debug1: identity file /Users/andrew/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.6
debug1: Remote protocol version 2.0, remote software version babeld-0f6ba948
debug1: compat_banner: no match: babeld-0f6ba948
debug1: Authenticating to github.com:22 as 'git'
debug1: load_hostkeys: fopen /Users/andrew/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU
debug1: load_hostkeys: fopen /Users/andrew/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host 'github.com' is known and matches the ED25519 host key.
debug1: Found key in /Users/andrew/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: pubkey_prepare: ssh_get_authentication_socket: Connection refused
debug1: Will attempt key: /Users/andrew/.ssh/id_ed25519 ED25519 SHA256:ZNVlhLvA3IphiEyIbkDc2uOfm4MHOD8/yAkt/rkiCNM explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /Users/andrew/.ssh/id_ed25519 ED25519 SHA256:ZNVlhLvA3IphiEyIbkDc2uOfm4MHOD8/yAkt/rkiCNM explicit
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
git@github.com: Permission denied (publickey).```

I'm on an M1 Mac. I'll try the setup flow too and report back...
ridicolos commented 2 years ago

So I now ran the setup flow from help and now it works. Didn't knew about this setup flow.

Thanks for the help

ridicolos commented 2 years ago

Maybe something about this setup should be added to the FAQ?

maxgoedjen commented 2 years ago

@ridicolos it runs automatically on initial install, but I'm not sure if there's a good way to detect uninstall/reinstall...

bermannoah commented 2 years ago

Whoa, I did not know about this flow and it would have saved me so much time -- I think just a sentence about it in the FAQ would do wonders.