Re: Trouble with GPG Cards for SSH when using FIDO2

[Philipp Schmidt]

Hello Werner,

thanks a lot for your reply and all the useful commands. Please excuse the late 
reply, but this one is getting me crazy since I am not able to create a 
situation in which I can reliably reproduce the failure. I guess that is due to 
OS updates as well.

Here are some of the edgy cases:

- When I launch a bash right after startup `ssh-add -L` displays all the keys 
and they remain even after the usage of FIDO

- When I come back from Lunch - waking up the box from logout - the keys are 
gone, even with the bash still open.

- In case the keys are gone, none of the scripts you provided change anything.

Maybe that is helpful here: The code from my `.bashrc`:

```
export GPG_TTY="$(tty)"
export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
gpgconf --launch gpg-agent
```

Adding `pscs-shared` completely breaks it, and it stops working.

I will further try to clearly reproduce it. Any hints are welcome.

THANKS FOR HELP!

Best Philipp


> Werner Koch  hat am 15.01.2024 17:04 CET geschrieben:
> 
>  
> On Mon, 15 Jan 2024 09:25, Philipp Schmidt said:
> 
> > - Everything works fine until I use one of the keys for FIDO2
> > - Afterwards I cannot restore the service without a reboot
> 
> Try to add
> 
>   pscs-shared
> 
> to scdaemon.conf and gpgconf -R scdaemon.  Does this change anything?
> If not, add
> 
>   log-file /foo/scd.log
>   debug ipc,reader,card
> 
> to scdaemon.conf and check the log file or send it to me.  Make sure
> that you did not enter the PIN as it would show up in the log.  If this
> does not give any hints, adding "debug cardio" will give even more
> verbose output.
> 
> 
> Salam-Shalom,
> 
>Werner
> 
> -- 
> The pioneers of a warless world are the youth that
> refuse military service. - A. Einstein

Philipp Schmidt (Diplom-Designer) | knutschmidt.de (http://knutschmidt.de) | 
phil...@knutschmidt.de | +49 176 23 43 27 79

public.asc
Description: application/pgp-keys


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
https://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Trouble with GPG Cards for SSH when using FIDO2

[Werner Koch via Gnupg-users]

Hi!

I would suggest that you put

debug ipc
log-file /foo/bar/agent.log

into gpg-agent.conf and

debug cardio
log-file /foo/bar/scd.log

into scdaemon.conf and restart them all (gpgconf -K all).  You way of
course also run watchgnupg to see a combined log but sepearte log files
are good enough.  The ssh handler has no dedicated debug statements and
thus any debug level is sufficient to see errors in the logs.  If you
don't see anything in the logs you either need to use a socket proxt
(somewhere in the gnupg source is one) or add debug statements to
command-ssh.c.  My guess is that the scdaemon log gives some hints.


Shalom-Salam,

   Werner


-- 
The pioneers of a warless world are the youth that
refuse military service. - A. Einstein


openpgp-digital-signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
https://lists.gnupg.org/mailman/listinfo/gnupg-users