Yubikey ssh authentication fails with "signing failed for ECDSA-SK"

tux_tina

I have a Yubikey (Security Key NFC by Yubico) that I'm trying to set up on a Linux machine for SSH authentication in Discoverable keys mode. I've followed this tutorial and created the keys with ssh-keygen -t ecdsa-sk -O resident -O application=ssh:YourTextHere -O verify-required After that, the pub key was copied to the destination server, and I can correctly login with ssh -i /root/.ssh/YourTextHere server However, when I try to connect...

Originally asked by user134167 on Stack Exchange (superuser) (CC BY-SA 4.0).

uphilltech

Great question — answering as the UphillTech team:

verify-required requires a way for ssh-agent to actually prompt for verification (whether it's a "touch" request or a PIN input prompt). The agent protocol does not include any way for it to relay prompts back to the calling program, so ssh-agent needs to directly start the ssh-askpass prompter. Make sure a version of ssh-askpass is installed (there are a few variants for different desktops, I think) and if necessary, set SSH_ASKPASS= to its path so that ssh-agent could find it.

Full answer by grawity: https://superuser.stackexchange.com/a/1804820 (CC BY-SA 4.0).

Need it done for your business? UphillTech.