Re: sign_and_send_pubkey: signing failed: agent refused operation

[Martin Sebor <msebor@gmail.com>]

On 6/1/20 12:10 PM, Frank Ch. Eigler wrote:
> Hi -
> 
>> git pull from the GCC and Glibc repos is failing for me with the error
>> below.  It worked fine last week and I haven't made any changes to my
>> ssh keys.
> 
> And are you logging in from the same workstation with access to the same
> set of ssh private keys?

Yes.

> 
>> Is this a transient glitch or has something changed recently that I
>> need to make some adjustments for?
> 
> I know of nothing relevant that has changed on the sourceware side.
> 
>> sign_and_send_pubkey: signing failed: agent refused operation
>> msebor@gcc.gnu.org: Permission denied (publickey).
>> fatal: Could not read from remote repository.
> 
> The usual advice is to run       % ssh -vv gcc.gnu.org alive
> and report the ssh level error.
> 
> "agent refused operation" sounds like a problem on the client end.

Until last week, when I ran git pull from the GCC or Glibc repo
I'd get prompted for my password.  I'd either type it in or hit
ctrl-C, enter ssh-add, and start over.

After deleting ~/.ssh/known_hosts to resolve the problem I asked
about last week (Re: ssh key conflicts), I'm no longer prompted
for my password.  Instead, I get the error above.

Both of this is new (I think since the recent server changes).  Now
that I've seen it and know what to expect I can adjust to it but it
seems like things have gotten worse.  Certainly the errors I got
in both instances (i.e., last week as well as today) are not helpful.

I captured the ssh -vv gcc.gnu.org output below for a successful
invocation and a failed one if that sheds more light on why it's
failing in (to me) a mysterious way.

Successful authentication:

debug1: Will attempt key: /home/msebor/.ssh/id_rsa RSA 
SHA256:law7uJ+wmAP4krZHnB0tLJ8M+ySmMCclh7mRB9Dlja4 agent
debug1: Will attempt key: /home/msebor/.ssh/id_ecdsa
debug1: Will attempt key: /home/msebor/.ssh/id_ed25519
debug1: Will attempt key: /home/msebor/.ssh/id_xmss
debug2: pubkey_prepare: done
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: 
server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/msebor/.ssh/id_rsa RSA 
SHA256:law7uJ+wmAP4krZHnB0tLJ8M+ySmMCclh7mRB9Dlja4 agent
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: /home/msebor/.ssh/id_rsa RSA 
SHA256:law7uJ+wmAP4krZHnB0tLJ8M+ySmMCclh7mRB9Dlja4 agent
debug1: Authentication succeeded (publickey).
Authenticated to gcc.gnu.org ([8.43.85.97]:22).

Failed authentication (after ssh-add -D):

debug1: Will attempt key: /home/msebor/.ssh/id_rsa RSA 
SHA256:law7uJ+wmAP4krZHnB0tLJ8M+ySmMCclh7mRB9Dlja4 agent
debug1: Will attempt key: /home/msebor/.ssh/id_ecdsa
debug1: Will attempt key: /home/msebor/.ssh/id_ed25519
debug1: Will attempt key: /home/msebor/.ssh/id_xmss
debug2: pubkey_prepare: done
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: 
server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/msebor/.ssh/id_rsa RSA 
SHA256:law7uJ+wmAP4krZHnB0tLJ8M+ySmMCclh7mRB9Dlja4 agent
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: /home/msebor/.ssh/id_rsa RSA 
SHA256:law7uJ+wmAP4krZHnB0tLJ8M+ySmMCclh7mRB9Dlja4 agent
sign_and_send_pubkey: signing failed: agent refused operation
debug1: Trying private key: /home/msebor/.ssh/id_ecdsa
debug1: Trying private key: /home/msebor/.ssh/id_ed25519
debug1: Trying private key: /home/msebor/.ssh/id_xmss
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
msebor@gcc.gnu.org: Permission denied (publickey).

Martin