[Bug]: step ssh certificate only adds the cert to ssh-agent and not the private key about cli

[redrac]

It was indeed copy paste from different sessions + obscuring my company. Thanks for tracking that down; I confirmed rm -f'ing the files does indeed allow SSH to work with just the cert in agent.

[maraino]

Hi @redrac, this is quite weird and I cannot reproduce it.

When you see only the ECDSA-CERT in the agent, the agent has both the private key and the certificate. When you see ECDSA too means that it also has the public key, the same one that is available in the certificate. This is the expected behavior:

user@host01 [16:40:32] ~ $ ssh-add -l
256 SHA256:zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz/OAvwmabJI/4 /home/user/.ssh/id_ecdsa (ECDSA-CERT)

I've tried with these version of ssh, but wasn't able to reproduce it:

• OpenSSH_9.4p1, OpenSSL 3.1.2 1 Aug 2023
• OpenSSH_9.0p1 Ubuntu-1ubuntu8.4, OpenSSL 3.0.8 7 Feb 2023
• OpenSSH_8.2p1 Ubuntu-4ubuntu0.9, OpenSSL 1.1.1f 31 Mar 2020

[maraino]

In my tests, instead of Enter passphrase for key '/home/user/.ssh/id_ecdsa': I see this:

$ ssh -v ssh.host
OpenSSH_8.2p1 Ubuntu-4ubuntu0.9, OpenSSL 1.1.1f  31 Mar 2020
...
debug1: Offering public key: [email protected] ECDSA-CERT SHA256:zzz agent
debug1: Server accepts key: [email protected] ECDSA-CERT SHA256:zzz agent
debug1: sign_and_send_pubkey: no separate private key for certificate "[email protected]"
debug1: Authentication succeeded (publickey).
Authenticated to ssh.host ([x.x.x.x]:22).
...

[maraino]

By the way, I've just noticed that the fingerprints in the ssh-add -l and ssh -v host02 are different:

• SHA256:zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz/OAvwmabJI/4
• SHA256:zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz/6WH2c+Gt8

Can this be related, or are just copypastes from different sessions?

[maraino]

@redrac I've been able to reproduce your behavior, but only if I store the files in /home/user/.ssh/id_ecdsa, it works as expected in any other case.

By the way, you can also use step ssh login [email protected] it will generate an ephemeral key that will be only in the agent.

[maraino]

After looking at the ssh source code, if using a certificate and it is in the default location, it will first use the file instead of the agent. As the SSH server accepts that certificate, the client will ask you for the password of the file.