2

I'm having an issue using my hardware security key with SSH on Monterey. The Apple-included OpenSSH build seems not to support hardware keys at all, as I get an error message saying Cannot load FIDO key <key> without provider.

To fix this, I have installed OpenSSH 8.8 from Homebrew. The first time I SSH with my key, it works as expected; however, all subsequent attempts generate the following error:

sign_and_send_pubkey: signing failed for ED25519-SK <key> from agent: agent refused operation
<REDACTED>: Permission denied (publickey).

In order to fix it, I need to killall ssh-agent every time. I never had this problem on Big Sur, and I'm not sure where to begin troubleshooting.

Looking a little deeper, whenever I run SSH, my Mac starts /usr/bin/ssh-agent and not my /opt/homebrew/bin/ssh-agent. Manually starting the Homebrew version of ssh-agent before running ssh does not fix this; the Mac still spawns the bundled ssh-agent so that both are running. It does this even when I explicitly run /opt/homebrew/bin/ssh.

2 Answers 2

2

Have you tried disabling the built-in agent? I found a blog post that explains this:

launchctl disable user/$UID/com.openssh.ssh-agent

I haven't tried it, but maybe it helps.

2
  • 2
    I had to follow a little more from that blog post, but this wound up working for me. Strangely, subsequent logins don't show me the "Confirm user presence for key" message, but it's a lot more useful than before. Thank you!
    – tiltowait
    Dec 18, 2021 at 19:31
  • Glad to have been of help! I'm trying to move to MacOS, but this kind of issues are driving me nuts (why would they not support SK in the built-in SSH?? Maybe I'll just stay with my Linux…
    – iustin
    Dec 19, 2021 at 20:21
1

Use Homebrew's OpenSSH

$ brew install openssh

Once installed, you have to override the one in your PATH by putting the OpenSSH folder at the beginning of your PATH in your RC file like this

$ export PATH=$(brew --prefix openssh)/bin:$PATH

Once you've done that and you've sourced your rc file you should be able to generate your key

Tested on macOS Monterey and OpenSSH_9.0p1, OpenSSL 1.1.1q 5 Jul 2022

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .