Git Product home page Git Product logo

Comments (13)

bernstei avatar bernstei commented on August 27, 2024 
sign_and_send_pubkey: signing failed: agent refused operation
git@<FQDN>: Permission denied (publickey).

keychain-pkcs11-popup

from keychain-pkcs11.

kenh avatar kenh commented on August 27, 2024

"Hm".

So the whole dynamics between "text PIN prompts" and the GUI popup is a little weird. The PKCS#11 API assumes that you're going to pass in the PIN via the API, but the Apple API doesn't QUITE support that in an obvious way. So I use a non-obvious way to do that (which I gleaned from the Apple old PKCS#11 ssh plug-in). And the type of error messages you can pass back via the PKCS#11 API is very limited.

If you run this command (listed in man keychain-pkcs11) when this happens, you should get a bunch of debugging output from the library. Could you send it to me? You need to start this command before you try the ssh command. You MIGHT need to be root to run it; if so, just use sudo. Also probably best to redirect the output to a file as I imagine there will be a lot of it.

log stream --predicate 'subsystem = "mil.navy.nrl.cmf.pkcs11"' --level debug

from keychain-pkcs11.

bernstei avatar bernstei commented on August 27, 2024

from keychain-pkcs11.

kenh avatar kenh commented on August 27, 2024

It looks like the critical error is:

2022-12-02 12:41:36.221764-0500 0x3136fc   Debug       0x0                  45841  0    ssh-pkcs11-helper: (keychain-pkcs11.dylib) [mil.navy.nrl.cmf.pkcs11:general] SecKeyCreateSignature failed: Error Domain=CryptoTokenKit Code=-5 "(null)"

Which is ... NOT HELPFUL.

I believe it might be possible to extract some debugging from CryptoTokenKit. I'll look into that and get back to you.

from keychain-pkcs11.

kenh avatar kenh commented on August 27, 2024

Alright, try this command:

sudo log stream --level debug --predicate 'subsystem = "com.apple.CryptoTokenKit" || subsystem = "mil.navy.nrl.cmf.pkcs11"'

It should produce the same output as above but with more stuff that will hopefully shed some details on the real error.

from keychain-pkcs11.

kenh avatar kenh commented on August 27, 2024

As a follow-up, I did find this in TKError.h:

TKErrorCodeAuthenticationFailed  = -5

Which, okay, I could have guessed that. But there is probably a deeper error that would be useful to see.

Do you have a time frame for when that PIN entry stops working? I am just wondering what it would take for me to reproduce it here.

I can think of some workarounds that could possibly work if I have an idea what is going wrong.

from keychain-pkcs11.

bernstei avatar bernstei commented on August 27, 2024

from keychain-pkcs11.

kenh avatar kenh commented on August 27, 2024

Hm, 10s of minutes? What version of MacOS X are you using?

from keychain-pkcs11.

bernstei avatar bernstei commented on August 27, 2024

from keychain-pkcs11.

bernstei avatar bernstei commented on August 27, 2024

from keychain-pkcs11.

kenh avatar kenh commented on August 27, 2024

Actually, I think that if you pull the card out and put it back in, and do not remove and re-add the pkcs11 module to the ssh agent, the first time you try to connect with ssh it'll trigger the GUI, and then the login will fail.

Okay, THAT I could believe.

From the PKCS#11 side, you're supposed to detect the card has been removed and then re-login in again and ssh
may not be doing that. Although I kind of wonder why you get a GUI pop-up and then a failure.

But ... I just tested this on Catalina and while I do get a GUI pop-up for the PIN after I re-insert the card it then succeeds. Silly question: are you using your PIV key with this repo, or your email key? I realize it may not be obvious to tell which one you are using. I might have to try it on Big Sur.

from keychain-pkcs11.

bernstei avatar bernstei commented on August 27, 2024

from keychain-pkcs11.

bernstei avatar bernstei commented on August 27, 2024

from keychain-pkcs11.

Related Issues (11)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.