Bug 3191 - Issues when authorized_keys contains more than one ecdsa-sk public key
Summary: Issues when authorized_keys contains more than one ecdsa-sk public key
Status: CLOSED WORKSFORME
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: 8.3p1
Hardware: amd64 Linux
: P5 enhancement
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-07-05 17:54 AEST by David Walker
Modified: 2021-04-23 14:57 AEST (History)
1 user (show)

See Also:


Attachments
5C Nano already inserted (13.50 KB, text/plain)
2020-07-18 08:15 AEST, David Walker
no flags Details
5 NFC already inserted (14.69 KB, text/plain)
2020-07-18 08:15 AEST, David Walker
no flags Details
No key inserted (16.21 KB, text/plain)
2020-07-18 08:15 AEST, David Walker
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description David Walker 2020-07-05 17:54:38 AEST
When I add two keys to .ssh/authorized_keys on a remote system, it appears that only one of them will be attempted (in only a couple of trials, it was the first key I'd created both times, even after I swapped the order of the two keys in .ssh/authorized_keys). This results in an error if the "right" key isn't already inserted. I would expect the correct behavior to be to attempt only remote-host-authorized keys that are inserted in the local host, and if none are inserted, to prompt the user to insert one.
Comment 1 Damien Miller 2020-07-17 13:57:58 AEST
If you post debug traces from the client and the server it might be possible to figure out what is going on here
Comment 2 David Walker 2020-07-18 08:13:21 AEST
Hmmm... I still have the issue of not being prompted to insert a key when no acceptable key is already inserted, but either of the keys I've authorized can be inserted and I get logged in without error. I'm pretty sure Tumbleweed has had an update to this stuff (libfido2 and maybe openssh) since I originally reported the issue, so it looks maybe like this has been resolved.

If it's useful, though, I'll attach logs for two cases where an authorized key is already inserted and one where no key is inserted. FYI, I tested this on my laptop by starting sshd on my laptop and "ssh -vvv localhost". The authorized_keys file contained only the two Yubikeys I've been testing with.
Comment 3 David Walker 2020-07-18 08:15:00 AEST
Created attachment 3429 [details]
5C Nano already inserted
Comment 4 David Walker 2020-07-18 08:15:29 AEST
Created attachment 3430 [details]
5 NFC already inserted
Comment 5 David Walker 2020-07-18 08:15:49 AEST
Created attachment 3431 [details]
No key inserted
Comment 6 Damien Miller 2020-07-31 13:08:22 AEST
it sounds like your problems were related to your OS distribution and not OpenSSH per se. Reopen if this is not the case.
Comment 7 Damien Miller 2021-04-23 14:57:39 AEST
closing resolved bugs as of 8.6p1 release