Bug 3111 - Option AddKeysToAgent does not load certificates into ssh-agent
Summary: Option AddKeysToAgent does not load certificates into ssh-agent
Status: NEW
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh-agent (show other bugs)
Version: 8.2p1
Hardware: All Linux
: P4 normal
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-01-14 05:12 AEDT by Justin Aplin
Modified: 2022-10-16 05:46 AEDT (History)
1 user (show)

See Also:


Attachments
Patch for the ssh agent certificate fix (3.10 KB, patch)
2022-10-16 05:46 AEDT, Finlay
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Justin Aplin 2020-01-14 05:12:18 AEDT
Using the option AddKeysToAgent loads key data, but not certificate data, into ssh-agent when a certificate is used to authenticate a session. Such a certificate thus cannot be used with agent forwarding unless manually loaded via ssh-add. Manual loading works as expected.

Reproduction setup:

foo and bar both accept keys signed by the same Certificate Authority. Each has a unique keypair signed by the same Certificate Authority.



Manual (working):

me@foo:~$ ssh-add ~/.ssh/id_ed25519
Enter passphrase for /home/me/.ssh/id_ed25519:
Identity added: /home/me/.ssh/id_ed25519 (me@foo)
Certificate added: /home/me/.ssh/id_ed25519-cert.pub (me@foo.local)
me@foo:~$ ssh-add -L
ssh-ed25519 x me@foo
ssh-ed25519-cert-v01@openssh.com x me@foo.local
me@foo:~$ ssh -A -v -o AddKeysToAgent=no me@bar.local
...
debug1: Offering public key: /home/me/.ssh/id_ed25519 ED25519-CERT SHA256:x agent
debug1: Server accepts key: /home/me/.ssh/id_ed25519 ED25519-CERT SHA256:x agent
debug1: Authentication succeeded (publickey).
...
me@bar:~$ ssh-add -L
ssh-ed25519 x me@foo
ssh-ed25519-cert-v01@openssh.com x me@foo.local
me@bar:~$ ssh -A -v -o AddKeysToAgent=no me@foo.local
...
debug1: Offering public key: me@foo ED25519-CERT SHA256:x agent
debug1: Server accepts key: me@foo ED25519-CERT SHA256:x agent
debug1: Authentication succeeded (publickey).
...
me@foo:~$



AddKeysToAgent (not working):

me@foo:~$ ssh-add -L
The agent has no identities.
me@foo:~$ ssh -A -v -o AddKeysToAgent=yes me@bar.local
...
debug1: Offering public key: /home/me/.ssh/id_ed25519-cert.pub ED25519-CERT SHA256:x
debug1: Server accepts key: /home/me/.ssh/id_ed25519-cert.pub ED25519-CERT SHA256:x
Enter passphrase for /home/me/.ssh/id_ed25519:
debug1: identity added to agent: /home/me/.ssh/id_ed25519
debug1: Authentication succeeded (publickey).
...
me@bar:~$ ssh-add -L
ssh-ed25519 x me@foo
me@bar:~$ ssh -A -v -o AddKeysToAgent=yes me@foo.local
...
debug1: Will attempt key: me@foo ED25519 SHA256:x agent
....
debug1: Offering public key: me@foo ED25519 SHA256:x agent
...
(authentication fails, or a local key is picked)
Comment 1 Finlay 2022-10-16 05:46:35 AEDT
Created attachment 3617 [details]
Patch for the ssh agent certificate fix

I have written a patch for this bug and a pull request has been created to merge it into master. The patch is attached