1

I have a MacBook M1 on which I have been using a Yubikey 5 to authenticate SSH logins to various systems. I recently got a Yubikey 5C so I wouldn't have to use adapters. I moved my keys over to it using the backup I created when I set up my first key. The gpg keys on both are identical. The 5 is used on other systems now.

Now the issue is that when I try to use the Yubikey 5C (new one) to connect over SSH I get this error after being asked for and having entered the PIN:

sign_and_send_pubkey: signing failed for ED25519 "cardno:xx xxx xx" from agent: agent refused operation

And the relevant output from ssh -vvv host:

debug1: Server accepts key: cardno:xx xxx xxx ED25519 SHA256:*REDACTED* agent
debug3: sign_and_send_pubkey: using publickey with ED25519 SHA256:*REDACTED*
debug3: sign_and_send_pubkey: signing using ssh-ed25519 SHA256:*REDACTED*
sign_and_send_pubkey: signing failed for ED25519 "cardno:xx xxx xxx" from agent: agent refused operation
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
user@host: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

The server side logs show nothing out of the ordinary, just that it accepted the key, started a session and then the client disconnects.

If I connect the Yubikey 5 with the adapter it all works again. If I connect the Yubikey 5C to another system having previously used the Yubikey 5 I get the same error.

What I've tried so far:

  • Removing the old key handle from ~/.gnupg/private-keys-v1.d. Deleting the .gnupg directory and starting over. Does not work. I use gpg --card-status and the fetch command to set it up, I make sure it's listed with ssh-add -L but nothing.

  • Removing the old key handle from ~/.gnupg/private-keys-v1.d. Deleting the .gnupg directory and starting over. Does not work. I use gpg --card-status and the fetch command to set it up, I make sure it's listed with ssh-add -L but nothing.

  • Restarting the agent with gpg-connect-agent killagent /bye doesn't help. gpg-connect-agent updatestartuptty /bye doesn't help either.

gpg --card-status works as expected for both keys.

I'm stuck. I don't know how to make it forget the old key and act like it was never connected. I've been at this for three hours today and have googled everything I can think of.

Any suggestions?

1
  • This might help.
    – Kate
    Dec 16, 2022 at 21:05

0

You must log in to answer this question.

Browse other questions tagged .