Bug 3191

Summary: Issues when authorized_keys contains more than one ecdsa-sk public key
Product: Portable OpenSSH Reporter: David Walker <David>
Component: sshdAssignee: Assigned to nobody <unassigned-bugs>
Status: CLOSED WORKSFORME    
Severity: enhancement CC: djm
Priority: P5    
Version: 8.3p1   
Hardware: amd64   
OS: Linux   
Attachments:
Description Flags
5C Nano already inserted
none
5 NFC already inserted
none
No key inserted none

Description David Walker 2020-07-05 17:54:38 AEST 
When I add two keys to .ssh/authorized_keys on a remote system, it appears that only one of them will be attempted (in only a couple of trials, it was the first key I'd created both times, even after I swapped the order of the two keys in .ssh/authorized_keys). This results in an error if the "right" key isn't already inserted. I would expect the correct behavior to be to attempt only remote-host-authorized keys that are inserted in the local host, and if none are inserted, to prompt the user to insert one.
Comment 1 Damien Miller 2020-07-17 13:57:58 AEST 
If you post debug traces from the client and the server it might be possible to figure out what is going on here
Comment 2 David Walker 2020-07-18 08:13:21 AEST 
Hmmm... I still have the issue of not being prompted to insert a key when no acceptable key is already inserted, but either of the keys I've authorized can be inserted and I get logged in without error. I'm pretty sure Tumbleweed has had an update to this stuff (libfido2 and maybe openssh) since I originally reported the issue, so it looks maybe like this has been resolved.

If it's useful, though, I'll attach logs for two cases where an authorized key is already inserted and one where no key is inserted. FYI, I tested this on my laptop by starting sshd on my laptop and "ssh -vvv localhost". The authorized_keys file contained only the two Yubikeys I've been testing with.
Comment 3 David Walker 2020-07-18 08:15:00 AEST 
Created attachment 3429 [details]
5C Nano already inserted
Comment 4 David Walker 2020-07-18 08:15:29 AEST 
Created attachment 3430 [details]
5 NFC already inserted
Comment 5 David Walker 2020-07-18 08:15:49 AEST 
Created attachment 3431 [details]
No key inserted
Comment 6 Damien Miller 2020-07-31 13:08:22 AEST 
it sounds like your problems were related to your OS distribution and not OpenSSH per se. Reopen if this is not the case.
Comment 7 Damien Miller 2021-04-23 14:57:39 AEST 
closing resolved bugs as of 8.6p1 release