search

maxgoedjen / secretive

Store SSH keys in the Secure Enclave
MIT License
7.22k stars 159 forks source link

SSH agent not working when screen is locked #462

Open fuomag9 opened 1 year ago

fuomag9 commented 1 year ago

After investigating what was causing #321 for me, I managed to replicate it in my case:

I'm using another device to access a third host using the secretive machine. This works, but only if the desktop is unlocked. As soon as the desktop is locked via the "Lock Screen" button AND you start a new SSH session (if you use one opened before the screen is locked it will still work) secretive will stop working for authentication with:

sign_and_send_pubkey: signing failed for ECDSA "ecdsa-sha2-nistp256" from agent: agent refused operation

I believe this is a different than #321 as there could be multiple causes for that to happened, so I opened this one

luckman212 commented 1 year ago

@fuomag9 Did you ever figure this one out?

fuomag9 commented 1 year ago

@fuomag9 Did you ever figure this one out?

Nope :(

v57 commented 10 months ago

As I understand it works as intended. T2 chip is locked while your account is locked. You can't use your key from another account with su yourname even if it's logged on (while it's logged off, agent not starts). I don't think that apple will allow any workaround as this would be a security issue

martinpaljak commented 2 months ago

This indeed sounds like "a feature, not a bug"