4 ms·

I tried this on my macbook pro today - latest OS version. First I installed openssh with brew. Then I found I could barely get the new ssh key working with GitH

I tried this on my macbook pro today - latest OS version. First I installed openssh with brew. Then I found I could barely get the new ssh key working with GitHub, frequently getting `sign_and_send_pubkey: signing failed for ECDSA-SK / invalid format` errors while trying to commit and not actually being prompted to press the Yubikey, despite it being plugged in and ready. I keep my mini Yubikey USB-C in my laptop persistently which I wonder could be the issue. Anybody else having similar issues?

exabrial 5y ago
Yubikeys seem to have multiple modes and have trouble switching between them. For instance in GPG mode, It's very difficult to switch back to U2F mode without unplugging. I wonder if this is your issue
- kylehotchkiss 5y ago
  Interesting! Any ideas of how to log which mode it's in to help debug this further? Would disabling unused modes help prevent this?
kylehotchkiss 5y ago
Upon further investigation (Copy-pasting things from random internet webpages like a good HN would do), running the following two commands seemed to help get the Yubikey SSH running a little more reliably with Github for me, including with Tower.app after making sure it has the correct PATH setup: `eval `ssh-agent -s`` `ssh-add` Without the eval ssh-agent command, `ssh-add` fails to add the ECDSA-SK key since Mac OS' SSH implementation doesn't seem to natively support it. I don't understand how running eval ssh-agent resolves it because that shouldn't persist very long with Mac OS' own SSH agent trying to run.
- beermonster 5y ago
  ssh for macOS has some Keychain integration built into it in lieu of ssh-agent, or something like that IIRC.
  - heyoni 5y ago
    I think that the keychain is used to memorize pass phrases and the ssh agent is used to memorize the keys themselves.
- hawthornio 5y ago
  Yeah I believe my mac machine has the following in `~/.ssh/config`: Host * AddKeysToAgent yes UseKeychain yes

exabrial 5y ago

Yubikeys seem to have multiple modes and have trouble switching between them. For instance in GPG mode, It's very difficult to switch back to U2F mode without unplugging. I wonder if this is your issue

kylehotchkiss 5y ago
Interesting! Any ideas of how to log which mode it's in to help debug this further? Would disabling unused modes help prevent this?

kylehotchkiss 5y ago

Upon further investigation (Copy-pasting things from random internet webpages like a good HN would do), running the following two commands seemed to help get the Yubikey SSH running a little more reliably with Github for me, including with Tower.app after making sure it has the correct PATH setup: `eval `ssh-agent -s`` `ssh-add` Without the eval ssh-agent command, `ssh-add` fails to add the ECDSA-SK key since Mac OS' SSH implementation doesn't seem to natively support it. I don't understand how running eval ssh-agent resolves it because that shouldn't persist very long with Mac OS' own SSH agent trying to run.

beermonster 5y ago
ssh for macOS has some Keychain integration built into it in lieu of ssh-agent, or something like that IIRC.
- heyoni 5y ago
  I think that the keychain is used to memorize pass phrases and the ssh agent is used to memorize the keys themselves.
hawthornio 5y ago
Yeah I believe my mac machine has the following in `~/.ssh/config`: Host * AddKeysToAgent yes UseKeychain yes