canonical / canonical/ubuntu-server-documentation
doc: ssh FIDO2 resident key instructions don't work on default Ubuntu desktop
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 89
- Forks
- 162
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 5
Description
This is one for @panlinux perhaps?
It seems that by default on Ubuntu, the ssh agent is supplied by gnupg, not by openssh, and that the gnupg ssh agent doesn't seem to work with ssh-add -K. It prompts for the PIN as expected (Enter PIN for authenticator:) but then fails with Unable to add key ECDSA-SK SHA256:... without asking to touch the authenticator.
A workaround is to eval ssh-agent, but then this works only in that particular terminal window and not across the desktop.
I think this should be documented, as it's surprising behaviour that breaks the workflow example described. Better would be a workaround to work across the entire desktop but I don't know how to arrange that off the top of my head.
Document: how-to/security/two-factor-authentication-with-u2f-or-fido.md
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read how-to/security/two-factor-authentication-with-u2f-or-fido.md and review the SSH key workflow described there. Verify the default Ubuntu desktop agent behavior and the documented eval ssh-agent workaround, then update the instructions to explain the failure and identify a desktop-wide workaround or limitation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ubuntu
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100