Comments (13)
sign_and_send_pubkey: signing failed: agent refused operation
git@<FQDN>: Permission denied (publickey).
from keychain-pkcs11.
"Hm".
So the whole dynamics between "text PIN prompts" and the GUI popup is a little weird. The PKCS#11 API assumes that you're going to pass in the PIN via the API, but the Apple API doesn't QUITE support that in an obvious way. So I use a non-obvious way to do that (which I gleaned from the Apple old PKCS#11 ssh plug-in). And the type of error messages you can pass back via the PKCS#11 API is very limited.
If you run this command (listed in man keychain-pkcs11
) when this happens, you should get a bunch of debugging output from the library. Could you send it to me? You need to start this command before you try the ssh command. You MIGHT need to be root to run it; if so, just use sudo
. Also probably best to redirect the output to a file as I imagine there will be a lot of it.
log stream --predicate 'subsystem = "mil.navy.nrl.cmf.pkcs11"' --level debug
from keychain-pkcs11.
from keychain-pkcs11.
It looks like the critical error is:
2022-12-02 12:41:36.221764-0500 0x3136fc Debug 0x0 45841 0 ssh-pkcs11-helper: (keychain-pkcs11.dylib) [mil.navy.nrl.cmf.pkcs11:general] SecKeyCreateSignature failed: Error Domain=CryptoTokenKit Code=-5 "(null)"
Which is ... NOT HELPFUL.
I believe it might be possible to extract some debugging from CryptoTokenKit. I'll look into that and get back to you.
from keychain-pkcs11.
Alright, try this command:
sudo log stream --level debug --predicate 'subsystem = "com.apple.CryptoTokenKit" || subsystem = "mil.navy.nrl.cmf.pkcs11"'
It should produce the same output as above but with more stuff that will hopefully shed some details on the real error.
from keychain-pkcs11.
As a follow-up, I did find this in TKError.h
:
TKErrorCodeAuthenticationFailed = -5
Which, okay, I could have guessed that. But there is probably a deeper error that would be useful to see.
Do you have a time frame for when that PIN entry stops working? I am just wondering what it would take for me to reproduce it here.
I can think of some workarounds that could possibly work if I have an idea what is going wrong.
from keychain-pkcs11.
from keychain-pkcs11.
Hm, 10s of minutes? What version of MacOS X are you using?
from keychain-pkcs11.
from keychain-pkcs11.
from keychain-pkcs11.
Actually, I think that if you pull the card out and put it back in, and do not remove and re-add the pkcs11 module to the ssh agent, the first time you try to connect with ssh it'll trigger the GUI, and then the login will fail.
Okay, THAT I could believe.
From the PKCS#11 side, you're supposed to detect the card has been removed and then re-login in again and ssh
may not be doing that. Although I kind of wonder why you get a GUI pop-up and then a failure.
But ... I just tested this on Catalina and while I do get a GUI pop-up for the PIN after I re-insert the card it then succeeds. Silly question: are you using your PIV key with this repo, or your email key? I realize it may not be obvious to tell which one you are using. I might have to try it on Big Sur.
from keychain-pkcs11.
from keychain-pkcs11.
from keychain-pkcs11.
Related Issues (11)
- Won't load in Firefox 61.0.1 64b/Mac HOT 9
- Does not call any C_Sign function ... when signing HOT 5
- Unable to use keychain-pkcs11 to list certificate stored into Keychain HOT 1
- Fails to compile under Xcode-10 HOT 7
- Current master fails to work as PKCS#11 library for OpenSSL HOT 28
- Async scan seems to fail or result is not waited on HOT 6
- SecCertificateCopyPublicKey deprecated HOT 2
- Fails to find slots HOT 1
- Crash in [@ DERDecodeSeqContentInit] in Firefox HOT 6
- How to use with Brew? HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from keychain-pkcs11.