4 ms·

There's also something weird going on with "-o BatchMode=yes", which is used by shells to tab-complete remote files for scp and rsync. I could ssh into a serve

by 0x0 10y ago

There's also something weird going on with "-o BatchMode=yes", which is used by shells to tab-complete remote files for scp and rsync. I could ssh into a server without typing the ssh key password, but zsh refused to tab-complete scp and rsync command lines. Turns out it was using "ssh -o BatchMode=yes servername somethingsomething" to retrieve a list of files, but "-o BatchMode=yes" prevented whatever magic is happening from unlocking the ssh key. Figuring this out was tricky because dtruss and lldb refused to attach to /bin/zsh and /usr/bin/ssh because of SIP. (In fact, "dtruss --help" lists "dtruss df -h" as the first example, something that doesn't even work on sierra because /bin/df is protected by SIP) The fix is to run "ssh-add -A" after booting. Very odd, since there are no password prompts involved anywhere.

pudquick 10y ago
The next time you'd like to diagnose, you can reboot into Recovery and use "csrutil enable --without dtrace --without debug" and you should be able to avoid those issues.
- 0x0 10y ago
  That's true. But too much of a hassle. One workaround is actually to just cp /bin/whatever to /tmp/whatever and debug that, but in this particular case I needed to follow forks (from zsh to ssh) so that wasn't as easy. Or I guess I could have played games with $PATH. Ah well. Either way, there is something funny going on with ssh and private keys and their passphrases. Very odd how "-o BatchMode=yes" fails to load encrypted private keys that don't require any user input in normal use. And it's definitively something new because this was never a problem in 10.11 or below.
  - pudquick 10y ago
    I think Apple stopped loading the passphrases into the agent automatically. I think they're strictly only loaded from the keychain now, per connection, unless you explicitly use -A to add them to the agent. Edit: Ah, and another comment here provided the answer: https://news.ycombinator.com/item?id=12654917 https://news.ycombinator.com/item?id=12654917

by 0x0 10y ago

pudquick 10y ago

The next time you'd like to diagnose, you can reboot into Recovery and use "csrutil enable --without dtrace --without debug" and you should be able to avoid those issues.

0x0 10y ago
That's true. But too much of a hassle. One workaround is actually to just cp /bin/whatever to /tmp/whatever and debug that, but in this particular case I needed to follow forks (from zsh to ssh) so that wasn't as easy. Or I guess I could have played games with $PATH. Ah well. Either way, there is something funny going on with ssh and private keys and their passphrases. Very odd how "-o BatchMode=yes" fails to load encrypted private keys that don't require any user input in normal use. And it's definitively something new because this was never a problem in 10.11 or below.
- pudquick 10y ago
  I think Apple stopped loading the passphrases into the agent automatically. I think they're strictly only loaded from the keychain now, per connection, unless you explicitly use -A to add them to the agent. Edit: Ah, and another comment here provided the answer: https://news.ycombinator.com/item?id=12654917 https://news.ycombinator.com/item?id=12654917