I can't exactly pinpoint which gnome package is responsible for this. It might be gnome-keyring. Let's go with gnome-shell first.
TL;DR openssh 8.2p1 in focal has support for U2F authentication. You can create a keypair and the authentication only succeeds if you have the u2f hardware device plugged in, and touch it at the moment of authentication.
In a console only env, it works like this:
"""
andreas@nsnx:~$ env|grep SSH
andreas@nsnx:~$ ssh -i .ssh/id_ecdsa_sk 10.0.100.75
Confirm user presence for key ECDSA-SK SHA256:bS6vX6b+Bp8Xu/LF4Gw10dV0Y6AkjFPjPoO5q0A546M
Welcome to Ubuntu Focal Fossa (development branch) (GNU/Linux 5.4.0-21-generic x86_64)
...
Last login: Tue Mar 31 13:35:44 2020 from 10.0.100.1
"""
The "Confirm" prompt is asking the user to touch the hardware device (a yubikey in this case).
If I use openssh's ssh-agent, it still works as expected and I see that prompt:
"""
andreas@nsnx:~$ env|grep SSH
andreas@nsnx:~$ eval $(ssh-agent)
Agent pid 68267
andreas@nsnx:~$ env|grep SSH
SSH_AUTH_SOCK=/tmp/ssh-75OwXd9gR6tq/agent.68252
SSH_AGENT_PID=68267
andreas@nsnx:~$ ssh -i .ssh/id_ecdsa_sk 10.0.100.75
Warning: Permanently added '10.0.100.75' (ECDSA) to the list of known hosts.
Confirm user presence for key ECDSA-SK SHA256:bS6vX6b+Bp8Xu/LF4Gw10dV0Y6AkjFPjPoO5q0A546M
Welcome to Ubuntu Focal Fossa (development branch) (GNU/Linux 5.4.0-21-generic x86_64)
(...)
Last login: Tue Mar 31 14:33:18 2020 from 10.0.100.1
"""
But with "gnome's ssh-agent" (I'm waving my hands here a bit), it just stalls. The prompt is swallowed by something. Here I opened a new gnome terminal in my existing focal desktop session:
"""
andreas@nsnx:~$ env|grep SSH
SSH_AUTH_SOCK=/run/user/1000/keyring/ssh
SSH_AGENT_PID=4655
andreas@nsnx:~$ ssh -i .ssh/id_ecdsa_sk 10.0.100.75
<hangs here, and the yubikey starts flashing>
"""
It only moves forward if I touch the device, which is expected. But the "Confirm user presence" prompt is nowhere to be seen.
I'm not sure how gnome-keyring interacts with ssh-agent. I see it is spawned by gnome-keyring-daemon:
4556 ? Sl 0:00 /usr/bin/gnome-keyring-daemon --daemonize --login
6449 ? S 0:00 \_ /usr/bin/ssh-agent -D -a /run/user/1000/keyring/.ssh
But the PID referenced by the SSH_AGENT_PID shell variable above points to another copy, spawned by gnome-session-binary:
4583 tty3 Sl+ 0:00 \_ /usr/libexec/gnome-session-binary --systemd --systemd --session=ubuntu
4655 ? Ss 0:00 \_ /usr/bin/ssh-agent /usr/bin/im-launch env GNOME_SHELL_SESSION_MODE=ubuntu /usr/bin/gnome-session --systemd --session=ubuntu
In any case, the actual prompt "Confirm user presence for key" comes from openssh code:
./ssh-agent.c: "Confirm user presence for key %s %s",
./sshconnect2.c: "Confirm user presence for key %s %s",
My guess is that the gnome wrapper, whatever it is, is not expecting that prompt.
ProblemType: Bug
DistroRelease: Ubuntu 20.04
Package: gnome-shell 3.36.0-2ubuntu2
ProcVersionSignature: Ubuntu 5.4.0-21.25-generic 5.4.27
Uname: Linux 5.4.0-21-generic x86_64
NonfreeKernelModules: zfs zunicode zavl icp zcommon znvpair
ApportVersion: 2.20.11-0ubuntu21
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Tue Mar 31 11:29:06 2020
DisplayManager: gdm3
InstallationDate: Installed on 2019-10-13 (169 days ago)
InstallationMedia: Ubuntu 19.10 "Eoan Ermine" - Beta amd64 (20191010)
RelatedPackageVersions: mutter-common 3.36.0-2ubuntu1
SourcePackage: gnome-shell
UpgradeStatus: Upgraded to focal on 2020-01-30 (60 days ago)
I can't exactly pinpoint which gnome package is responsible for this. It might be gnome-keyring. Let's go with gnome-shell first.
TL;DR openssh 8.2p1 in focal has support for U2F authentication. You can create a keypair and the authentication only succeeds if you have the u2f hardware device plugged in, and touch it at the moment of authentication.
In a console only env, it works like this: bS6vX6b+ Bp8Xu/LF4Gw10dV 0Y6AkjFPjPoO5q0 A546M
"""
andreas@nsnx:~$ env|grep SSH
andreas@nsnx:~$ ssh -i .ssh/id_ecdsa_sk 10.0.100.75
Confirm user presence for key ECDSA-SK SHA256:
Welcome to Ubuntu Focal Fossa (development branch) (GNU/Linux 5.4.0-21-generic x86_64)
...
Last login: Tue Mar 31 13:35:44 2020 from 10.0.100.1
"""
The "Confirm" prompt is asking the user to touch the hardware device (a yubikey in this case).
If I use openssh's ssh-agent, it still works as expected and I see that prompt:
""" SOCK=/tmp/ ssh-75OwXd9gR6t q/agent. 68252 bS6vX6b+ Bp8Xu/LF4Gw10dV 0Y6AkjFPjPoO5q0 A546M
andreas@nsnx:~$ env|grep SSH
andreas@nsnx:~$ eval $(ssh-agent)
Agent pid 68267
andreas@nsnx:~$ env|grep SSH
SSH_AUTH_
SSH_AGENT_PID=68267
andreas@nsnx:~$ ssh -i .ssh/id_ecdsa_sk 10.0.100.75
Warning: Permanently added '10.0.100.75' (ECDSA) to the list of known hosts.
Confirm user presence for key ECDSA-SK SHA256:
Welcome to Ubuntu Focal Fossa (development branch) (GNU/Linux 5.4.0-21-generic x86_64)
(...)
Last login: Tue Mar 31 14:33:18 2020 from 10.0.100.1
"""
But with "gnome's ssh-agent" (I'm waving my hands here a bit), it just stalls. The prompt is swallowed by something. Here I opened a new gnome terminal in my existing focal desktop session:
""" SOCK=/run/ user/1000/ keyring/ ssh
andreas@nsnx:~$ env|grep SSH
SSH_AUTH_
SSH_AGENT_PID=4655
andreas@nsnx:~$ ssh -i .ssh/id_ecdsa_sk 10.0.100.75
<hangs here, and the yubikey starts flashing>
"""
It only moves forward if I touch the device, which is expected. But the "Confirm user presence" prompt is nowhere to be seen.
I'm not sure how gnome-keyring interacts with ssh-agent. I see it is spawned by gnome-keyring- daemon: gnome-keyring- daemon --daemonize --login 1000/keyring/ .ssh
4556 ? Sl 0:00 /usr/bin/
6449 ? S 0:00 \_ /usr/bin/ssh-agent -D -a /run/user/
But the PID referenced by the SSH_AGENT_PID shell variable above points to another copy, spawned by gnome-session- binary: gnome-session- binary --systemd --systemd --session=ubuntu SESSION_ MODE=ubuntu /usr/bin/ gnome-session --systemd --session=ubuntu
4583 tty3 Sl+ 0:00 \_ /usr/libexec/
4655 ? Ss 0:00 \_ /usr/bin/ssh-agent /usr/bin/im-launch env GNOME_SHELL_
In any case, the actual prompt "Confirm user presence for key" comes from openssh code:
./ssh-agent.c: "Confirm user presence for key %s %s",
./sshconnect2.c: "Confirm user presence for key %s %s",
My guess is that the gnome wrapper, whatever it is, is not expecting that prompt.
ProblemType: Bug ature: Ubuntu 5.4.0-21.25-generic 5.4.27 dules: zfs zunicode zavl icp zcommon znvpair ersions: mutter-common 3.36.0-2ubuntu1
DistroRelease: Ubuntu 20.04
Package: gnome-shell 3.36.0-2ubuntu2
ProcVersionSign
Uname: Linux 5.4.0-21-generic x86_64
NonfreeKernelMo
ApportVersion: 2.20.11-0ubuntu21
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Tue Mar 31 11:29:06 2020
DisplayManager: gdm3
InstallationDate: Installed on 2019-10-13 (169 days ago)
InstallationMedia: Ubuntu 19.10 "Eoan Ermine" - Beta amd64 (20191010)
RelatedPackageV
SourcePackage: gnome-shell
UpgradeStatus: Upgraded to focal on 2020-01-30 (60 days ago)