SSH - 'Agent Refused Operation'

I'm seeing this too when attempting to access Azure DevOps (ssh.dev.azure.com).

With a very stripped back SSH config for debugging, I cannot seem to trace the cause. Even with a brand new key, same error.

debug1: Host 'ssh.dev.azure.com' is known and matches the RSA host key.
debug1: Found key in /Users/jamie/.ssh/known_hosts:4
debug1: rekey out after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 4294967296 blocks
debug1: Will attempt key: /Users/jamie/.ssh/azure_devops.pub RSA SHA256: explicit agent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: password,publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /Users/jamie/.ssh/azure_devops.pub RSA SHA256: explicit agent
debug1: Server accepts key: /Users/jamie/.ssh/azure_devops.pub RSA SHA256: explicit agent
sign_and_send_pubkey: signing failed for RSA "/Users/jamie/.ssh/azure_devops.pub" from agent: agent refused operation

Also noticed that keys not secured in the "Private" vault are not provided by the agent, is that a bug or by design?

Do you see anything appear in the logs when you invoke the SSH command? On macOS: ~/Library/Group Containers/2BUA8C4S2C.com.1password/Library/Application Support/1Password/Data/logs/1Password_rCURRENT.log

It could be that the EC2 instance only supports SHA1 signatures for RSA keys. This is something that the SSH agent doesn't support at the moment. If that's the case, you can consider switching to Ed25519 keys, or upgrading OpenSSH on your server so that it supports more modern algorithms.

For Azure DevOps, that's not an option unfortunately. So be on the lookout for updates! (Either from our side or from Azure's side)

@jamie_shaw About the Private vault requirement, see this thread.

I see the following error:

ERROR 2022-03-21T16:51:32.966 tokio-runtime-worker(ThreadId(3)) [1P:/Users/builder/builds/BhfSvM9x/0/dev/core/core/ssh/op-ssh-agent/src/lib.rs:377] Error handling sign request: Key(signing with ssh-rsa is unsupported; SHA-1 may be insecure)

To be fair I tested with a legacy EC2 instance so I'll try out a few more recent EC2's.

OK I tested out with some relatively new Amazon Linux EC2's and it works well.

@floris_1P are you likely to include supporting old ciphers in the 1password SSH agent? To update SSH on all of our older/legacy instances would be a considerable amount of work. Long term we will be of course sunsetting/upgrading/replacing instances for security purposes but short term we can't commit to using the 1password agent without 'old' cipher support.

Yes, for that exact reason we have plans to also support ssh-rsa in the near future.

we have plans to also support ssh-rsa in the near future

Nice! Then I can start using the 1Password SSH agent for all my keys (currently can't for 1 Azure DevOps key at work).

Can a disclaimer/troubleshooting info or section be added to the SSH Agent page? https://developer.1password.com/docs/ssh/agent/

I spent a few hours trying to figure out why I wasn't able to auth to a host using an RSA key. It's not explicitly stated that the agent wont work with RSA keys, and on the key management page, RSA is shown as a supported key type for import/storage, which sort of implies that you can use RSA keys with the agent, since they can be stored by 1Pass properly

I agree with dacodev. Please add a disclaimer. I'm scratching my hair off this morning until I found this post.

Waiting for ssh-rsa support to go full-in with 1password SSH keys!

@floris_1P Could you advise please, if there is at least an approximate ETA set for ssh-rsa keysig algorithm support?
As I have to manage a bunch of legacy servers, the lack of this algo is really a showstopper for using this great 1Passowrd's feature.