mobile-shell / mobile-shell/mosh

mosh does not ask to confirm user presence when authenticating with a FIDO2 security key

Open
#1,344 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
14.5k
Forks
865
PR merge metrics
No merged PRs in 30d

Description

the components

Server:

  • Gentoo Linux 2.17
  • mosh 1.4.0 [build mosh 1.4.0]
  • OpenSSH_10.0p2, OpenSSL 3.4.1 11 Feb 2025
  • Linux 6.12.31-gentoo # 1 SMP PREEMPT_DYNAMIC Sun Jun 22 11:12:27 CEST 2025 x86_64 Intel(R) Core(TM) i5-9300H CPU @ 2.40GHz GenuineIntel GNU/Linux

Client:

  • macOS 15.5 (24F74)
  • mosh 1.4.0 [build mosh 1.4.0]
  • OpenSSH_9.9p2, OpenSSL 3.5.0 8 Apr 2025
  • Darwin 24.5.0 Darwin Kernel Version 24.5.0: Tue Apr 22 19:54:49 PDT 2025; root:xnu-11417.121.6~2/RELEASE_ARM64_T6000 arm64

Authentication method: ed25519-sk using a YubiKey 5C NFC FW 5.4.3

the setup
  1. create a pseudo-keypair for a FIDO2 Security Key using ssh-keygen -t ed25519-sk
  2. copy public key to host
  3. (configure ssh to use said pseudo-private key if necessary; to test run ssh <host>)
  4. run mosh <host>
  5. (confirm presence by touching button on security key to make sure authentication itself works)
the problem

expected outcome: mosh asks to confirm user presence like ssh does: Confirm user presence for key ED25519-SK SHA256:<fingerprint>
actual outcome: nothing on the command line. Authentication still works if presence is confirmed anyhow.

Addenda
  1. running the commands manually yields the expected results
  2. the issue is not limited to the platforms mentioned above, the same thing happens with Gentoo as the client and Debian as the server platform.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named in the issue. Reproduce the behavior with mosh <host> and compare it with ssh <host> using an ed25519-sk key; trace the mosh authentication flow and verify that the user-presence prompt appears while authentication still succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, linux, macos
Domain
authentication, cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.