4

GateKeeper seems to have started blocking aspects of ssh... Can I edit the System Policy database (/var/db/SystemPolicy) to allow ssh to run properly?

This started happening (a few days) after I created an ~/.ssh/id_rsa file. It seems ssh hangs when trying to parse this file. It has permissions of 600, and is owned by my uid.

$ ssh -v <user>@<host>
....
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: ~/.ssh/id_rsa
debug1: key_parse_private_pem: PEM_read_PrivateKey failed
debug1: read PEM private key done: type <unknown>

Here, ssh hangs, and I get the following in /var/log/system.log

coreservicesd[30]: Application App:"SecurityAgent" [ 0x0/0x864363b]  @ 0x0x7fb6fb012670 tried to be brought forward, but isn't in fPermittedFrontASNs ( ( ASN:0x0-0x1001:) ), so denying.
WindowServer[120]: [cps/setfront] Failed setting the front application to SecurityAgent, psn 0x0-0x864363b, securitySessionID=0x186a4, err=-13066
com.apple.SecurityServer[15]: Engine::authorize: Rule::evaluate returned 4294907288 returning errAuthorizationInternal

If I run spctl --master-disable, then ssh works as expected, but obviously my security settings are diminished. Any idea how I can get ssh to work without disabling GateKeeper entirely?

UPDATE:-

The spctl --master-disable trick doesn't work for me any more :(
Since asking the question, I have updated to OSX 10.8.1. Not sure if that's related, but I can't think of anything else that would affect the ssh security policy.
So now, I can't commit anything to github!! :@
Help!?

UPDATE2:-

For some reason unbeknown to me, ssh and git would ask me for the id_rsa password (and then actually authenticate / connect) if I was in a fresh terminal session. I use tmux (like screen, which comes pre-installed on OSX, but I prefer tmux), in which I keep my bash sessions open for days, or weeks at a time. In an old tmux shell, I get the errors as described above, but in a fresh bash session, there are no error messages, and everything works as expected, even with spctl --master-enable..

Anyone know why this is, or how to re-authenticate a shell??

Improve this question
3
  • Are you sure this is Gatekeeper? Gatekeeper only applies to 'files downloaded from the internet' and not for your own creations or things you got from other networks or devices. Also, for *.app things, GK may be permanently disabled by running it by right-clicking and selecting 'open'. You would no longer be prompted. I'd guess this happens due to some other component of the system.
    – GhostLyrics
    Oct 8, 2012 at 11:51
  • Are you still having this issue?
    – Corey Edwards
    Oct 12, 2012 at 1:48
  • @GhostLyrics. Yea, I agree with you. This shouldn't be a GateKeeper issue. ssh comes pre-installed on every Mac, AFAIK, so should be exempt from GK's security policies. @Corey. No, not really. I've disabled the use of the id_rsa key by default, in ~/.ssh/config. Now, only connections to github.com use the key. I just tested it in an old tmux session, and it connected fine. Those warnings in the syslog didn't appear either.
    – Alex Leach
    Oct 12, 2012 at 11:47

1 Answer 1

Reset to default
1

Check .ssh/id_rsa and make sure you still have these lines on top and bottom:

-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----

They are crucial to the functionality of the SSH PubKeyAuth setup. Looking at the output from your debug, it appears that SSH is complaining about not knowing what type of key it is, which is defined by the first line. Likewise, after considering this, I removed the first line from my own private key, and SSH suddenly started bugging me to enter my passphrase for the key.

If this solution doesn't work, I'm afraid your only option will most likely be to re-generate your key pair.

Improve this answer
1
  • My private key does have those tags you mentioned. It's a password-protected key, though, which I think is why SSH initially complains about not knowing what type of key it is.
    – Alex Leach
    Oct 12, 2012 at 11:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .