Thanks for the detailed report! We will investigate this. One question I have: do you only experience this issue with an agent forwarding setup or with any Net::SSH request?

Thanks for taking a look at this!

Net::SSH works when I'm not executing a task which requires the agent for additional SSH authentication. It does the initial login just fine and I can change the command that's executed (line 7 of my script above) to something like hostname and get back expected output.

I have ForwardAgent yes in my ~/.ssh/config enabled, so Agent Forwarding is always turned on, but I don't get back the 'frozen String' thing unless the situation calls for it.

@floris_1P Just wanted to provide an update as it seems something has changed in the behavior of 1P8's SSH beta, but not quite working, yet:


D, [2022-03-09T11:17:20.822210 #59255] DEBUG -- net.ssh.authentication.agent[294]: sending agent request 13 len 1208
D, [2022-03-09T11:17:20.836267 #59255] DEBUG -- net.ssh.authentication.agent[294]: received agent packet 5 len 1
Traceback (most recent call last):
12: from ./stub.rb:6:in `<main>'
11: from /.asdf/installs/ruby/2.7.5/lib/ruby/gems/2.7.0/gems/net-ssh-6.1.0/lib/net/ssh.rb:255:in `start'
10: from /.asdf/installs/ruby/2.7.5/lib/ruby/gems/2.7.0/gems/net-ssh-6.1.0/lib/net/ssh/authentication/session.rb:72:in `authenticate'
9: from /.asdf/installs/ruby/2.7.5/lib/ruby/gems/2.7.0/gems/net-ssh-6.1.0/lib/net/ssh/authentication/session.rb:72:in `each'
8: from /.asdf/installs/ruby/2.7.5/lib/ruby/gems/2.7.0/gems/net-ssh-6.1.0/lib/net/ssh/authentication/session.rb:86:in `block in authenticate'
7: from /.asdf/installs/ruby/2.7.5/lib/ruby/gems/2.7.0/gems/net-ssh-6.1.0/lib/net/ssh/authentication/methods/publickey.rb:19:in `authenticate'
6: from /.asdf/installs/ruby/2.7.5/lib/ruby/gems/2.7.0/gems/net-ssh-6.1.0/lib/net/ssh/authentication/key_manager.rb:114:in `each_identity'
5: from /.asdf/installs/ruby/2.7.5/lib/ruby/gems/2.7.0/gems/net-ssh-6.1.0/lib/net/ssh/authentication/key_manager.rb:114:in `each'
4: from /.asdf/installs/ruby/2.7.5/lib/ruby/gems/2.7.0/gems/net-ssh-6.1.0/lib/net/ssh/authentication/key_manager.rb:122:in `block in each_identity'
3: from /.asdf/installs/ruby/2.7.5/lib/ruby/gems/2.7.0/gems/net-ssh-6.1.0/lib/net/ssh/authentication/methods/publickey.rb:20:in `block in authenticate'
2: from /.asdf/installs/ruby/2.7.5/lib/ruby/gems/2.7.0/gems/net-ssh-6.1.0/lib/net/ssh/authentication/methods/publickey.rb:62:in `authenticate_with'
1: from/.asdf/installs/ruby/2.7.5/lib/ruby/gems/2.7.0/gems/net-ssh-6.1.0/lib/net/ssh/authentication/key_manager.rb:180:in `sign'
/Users/ssmith/.asdf/installs/ruby/2.7.5/lib/ruby/gems/2.7.0/gems/net-ssh-6.1.0/lib/net/ssh/authentication/agent.rb:155:in `sign': agent could not sign data with requested identity (Net::SSH::Authentication::AgentError)

I'm still using the original configuration and code from the first post to test. It seems we're getting further along, but still missing something with regard to https://github.com/net-ssh/net-ssh/blob/v6.1.0/lib/net/ssh/authentication/agent.rb#L155. I'm not sure how to provide additional information, so if there's something else you'd like me to try, please let me know.

Thanks for making progress on this!

@SeanSith anything you're seeing in the logs the moment you invoke the SSH request? ~/Library/Group Containers/2BUA8C4S2C.com.1password/Library/Application Support/1Password/Data/logs/1Password_rCURRENT.log on Mac.

@floris_1P When I made the request, here is what I received:

WARN 2022-03-15T13:47:35.052 tokio-runtime-worker(ThreadId(2)) [1P:ssh/op-ssh-agent/src/codec.rs:48] failed to decode agent message
WARN 2022-03-15T13:47:35.052 tokio-runtime-worker(ThreadId(2)) [1P:ssh/op-ssh-agent/src/lib.rs:252] failed to receive agent request (Protocol), replying with SSH_AGENT_FAILURE
ERROR 2022-03-15T13:47:53.540 tokio-runtime-worker(ThreadId(6)) [1P:/Users/builder/builds/BhfSvM9x/0/dev/core/core/ssh/op-ssh-agent/src/lib.rs:377] Error handling sign request: Key(signing with ssh-rsa is unsupported; SHA-1 may be insecure)


Ah yes, the agent currently doesn't support SHA1 signatures. I'm not sure if Capistrano lets you configure that it should use a more modern host key algorithm like rsa-sha2-256 and that your server supports that too, but if not you could also consider switching to Ed25519 keys for now.

@floris_1P Understood. I'd started some other testing after reviewing the logs you requested earlier. I archived my existing RSA keys in 1Password, leaving only my ed25519 key active, and the test script above started working (as does a test deployment using Capistrano as mentioned in my original post).

As you pointed out, the issue is SHA1 signing, and apparently https://github.com/net-ssh/net-ssh/blob/v6.1/lib/net/ssh/transport/algorithms.rb#L27, but https://github.com/net-ssh/net-ssh/blob/master/lib/net/ssh/transport/algorithms.rb#L37http:// in the next major release. I suppose leaving my RSA keys disabled for now until SHA2-256/512 signing is implemented is the best course.

Thanks for helping me get this far and to you and the team for fixing up the agent response issue which began the initial thread. The SSH support is very welcome and will hopefully be a good selling point in expanding our 1Password usage.

One last thing, though. Thanks to you showing me the 1P8 log, I saw these errors when successfully using my ed25519 key during the testing above:

WARN 2022-03-15T17:08:47.993 tokio-runtime-worker(ThreadId(7)) [1P:ssh/op-ssh-agent/src/codec.rs:48] failed to decode agent message
WARN 2022-03-15T17:08:47.994 tokio-runtime-worker(ThreadId(7)) [1P:ssh/op-ssh-agent/src/lib.rs:252] failed to receive agent request (Protocol), replying with SSH_AGENT_FAILURE
WARN 2022-03-15T17:08:48.787 tokio-runtime-worker(ThreadId(10)) [1P:ssh/op-ssh-agent/src/codec.rs:48] failed to decode agent message
WARN 2022-03-15T17:08:48.788 tokio-runtime-worker(ThreadId(10)) [1P:ssh/op-ssh-agent/src/lib.rs:252] failed to receive agent request (Protocol), replying with SSH_AGENT_FAILURE
WARN 2022-03-15T17:08:48.973 tokio-runtime-worker(ThreadId(5)) [1P:ssh/op-ssh-agent/src/codec.rs:48] failed to decode agent message
WARN 2022-03-15T17:08:48.973 tokio-runtime-worker(ThreadId(5)) [1P:ssh/op-ssh-agent/src/lib.rs:252] failed to receive agent request (Protocol), replying with SSH_AGENT_FAILURE

The authentication and subsequent pass-through was, in fact, successful. Didn't know if that was something that you wanted to look at?

@SeanSith An update on ssh-rsa: the latest 1Password beta now supports this!

@SeanSith I am running into this same issue with my Capistrano deploys. I have SHA256 Ed25519 key and 1p ssh-agent configured, but it's failing to pass the credential, with the same error in your latest post. Is my understanding correct that this is not a 1p issue but a ruby Net::SSH issue (specifically, Net::SSH does not support SHA256 keys)? Is the solution to revert to using a SHA1 key until Net::SSH is updated? (Or is there a better solution with Capistrano?)

Update, this fixed it:

``` diff
diff --git a/Gemfile b/Gemfile
index 66eacd0..6eac71d 100644
--- a/Gemfile
+++ b/Gemfile
@@ -51,6 +51,8 @@ group :development do
gem 'capistrano-rvm', require: false
gem 'capistrano-sidekiq', require: false
gem 'capistrano-webpacker-precompile', require: false
+ gem 'ed25519', require: false
+ gem 'bcrypt_pbkdf', require: false
end

group :test do
```