Core Tunnel support for FIDO2/OpenSSH security-key

Core Tunnel Request Feature
,
1

Hi,
This combination with Yubikey FIDO-pin and OpenSSH security-key results in: “Invalid format, Permission denied.”:

”ssh-keygen -t ed25519-sk -O verify-required -C "your_email@example.com" -f ~/.ssh/id_ed25519_sk”

Will there be any support for it in the near future?

Licensed user

2

Hi Peterr, would you be able to provide the full connection log with Log Level set to "DEBUG3"?

Yang

3

Hi Yang, thank you for your response.
Here is the anonimized log for debugging purposes as requested:

debug.log (13.5 KB)

4

Thank you for the log. Could you please also run following command in a local terminal, and paste the output?

ssh -N -i /Users/testuser/.ssh/id_ed25519_sk -vvv -D 1080 -o ServerAliveInterval=15 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes -p 22 testuser@jump.example.com

Thank you,

Yang

5

Sure, see attached the new debug2.log.
Is asks for passphrase (ssh-key), a PIN (yubikey) and a Touch of presence (yubikey) and then the tunnel is operational.

Thanks for looking into it.

debug2.log (16.0 KB)

6

Please add a new entry in Environment Variables list:

SSH_SK_HELPER  /opt/homebrew/Cellar/openssh/10.3p1/libexec/ssh-sk-helper

image
image1280×956 69 KB

Then try connection again.

7

That helped a lot, it works now.
Great work, thank you.

8

macOS ships a version of ssh-sk-helper with FIDO2 support disabled. This environment variable instructs Core Tunnel to use the Homebrew version instead.