Skip to main content
kzolnowski
May 20, 2022
Question

ssh-agent stopped working

  • May 20, 2022
  • 33 replies
  • 2031 views

Hi,

After last nigthly update ssh-agent stopped working with error:
sign_and_send_pubkey: signing failed for ED25519 "SSH key ed25519 private" from agent: agent refused operation

Here's a log:

INFO 2022-05-20T09:38:39.891 tokio-runtime-worker(ThreadId(16)) [1P:ssh/op-agent-controller/src/desktop.rs:311] SSH Agent has started.
WARN 2022-05-20T09:42:55.966 tokio-runtime-worker(ThreadId(16)) [1P:ssh/op-session-info/src/macos.rs:39] no top level process found, launchd is missing from process tree
WARN 2022-05-20T09:42:55.966 tokio-runtime-worker(ThreadId(16)) [1P:ssh/op-ssh-agent/src/lib.rs:356] Unable to get client_info for pid: 3445
WARN 2022-05-20T09:47:04.442 tokio-runtime-worker(ThreadId(15)) [1P:ssh/op-session-info/src/macos.rs:39] no top level process found, launchd is missing from process tree
WARN 2022-05-20T09:47:04.443 tokio-runtime-worker(ThreadId(15)) [1P:ssh/op-ssh-agent/src/lib.rs:356] Unable to get client_info for pid: 3633

Could you please help me?


1Password Version: 8.8.0 80800101, on NIGHTLY channel
Extension Version: Not Provided
OS Version: macOS 12.3.1

33 replies

ravron
January 4, 2023

Done. The support ID number I received is [#IFU-93959-615].

January 4, 2023

I have also started seeing this issue and sent a diagnostic report of my own. What's strange is that this only appears to be happening on one particular git repo for me. All of my other git repos (same host, github.com) seem to work fine. I've tried restarting 1password and my computer to no avail. I've also tried recloning the repo to no avail. I am using Alacritty, tmux, and zsh on a fresh install of macOS.

The ticket number I got back is: #DMI-82239-715

January 6, 2023

I'm seeing this too (Mac, 1Password 8.9.11, Terminal.app):

sign_and_send_pubkey: signing failed for ED25519 "SSH Key" from agent: agent refused operation

In my case the issue seems to be because I use a Touch ID laptop with an external display and the lid closed. If I open the lid, quit/lock 1Password, and unlock using Touch ID then my SSH command works. I can then close the lid and it continues to work.

The clue for this was in the logs:

ERROR 2023-01-06T09:37:30.131 tokio-runtime-worker(ThreadId(4)) [1P:op-automated-unlock/src/lib.rs:295] Failed to authorize using system biometry: FailedToUnlockWithKeys(BiometryUnavailable)
INFO 2023-01-06T09:37:30.131 tokio-runtime-worker(ThreadId(4)) [1P:ssh/op-ssh-agent/src/lib.rs:460] Session was not authorized

January 10, 2023

Done, the support ID is [#MWS-48134-783]. Thank you!

January 16, 2023

Same. :)

[#KIL-32375-262]

Jack_P_1P
1Password Employee
1Password Employee
January 17, 2023

Thanks folks!

January 30, 2023

1P was working fine on my MacPro until a recent restart, which also installed a new Beta of 1Password (not Ventura).
sign_and_send_pubkey: signing failed for ED25519 "whatever" from agent: agent refused operation

Using:
1Password for Mac 8.10.0 (81000032)

I'm being forced onto "Nightly" version, for whatever reason (not by choice, tried Production, rebooting, etc, but, I keep being forced into Nightly).

Tried with Apple Terminal, as well as Warp terminal. Prefer Warp.

Worked this morning, now all ssh is broken for authentication whilst I undo the use of 1P.

January 30, 2023

Okay, found workaround; seems that something in a recent beta changed for the SSH agent somewhat significantly; different UI elements from the previous versions as well. Shut system down, restarted, still had error, but, found that for some reason the update disabled my Apple Watch, so, the error about refusing operation was really about not having a biometric device connected (looked in Console logs).

ravron
February 15, 2023

It looks like version 8.10.0 has adjusted the behavior. The release notes say:

The SSH agent will now show an “Unknown app” auth prompt for apps that aren’t supported instead of rejecting the request.

Sure enough, I'm no longer seeing failures when I run my test script. Instead, 1P requests my fingerprint significantly more often. The first time I try to sign a commit in a new shell, the prompt is exactly as before:

But on later commit signatures, when I believe it would have failed prior to version 8.10.0, it now says that "op-ssh-sign" is requesting to do the signature:

This suggests that 1P is still frequently (but not always!) unable to identify the requesting app, but is falling back rather than failing entirely as it would before 8.10.0. This is still a better experience than having >50% of my SSH key operations fail, but it does mean I have to authenticate way too often. Unfortunately, now that the SSH operations don't fail entirely, running test scripts to keep trying to track down the issue is marginally more annoying.

I'm not sure if you all do this sort of thing, but feel free to contact me privately if an engineer over there would be willing to investigate this live with me.

February 16, 2023

New MacBook Pro M2

  • 1Password for Mac 8.10.0 (81000055) (on PRODUCTION channel) (via homebrew)
  • macOS 13.2.1 22D68 arm64
  • normal, stock Terminal.app

Time Machine restore from an Intel MBPro


$ ssh-add -l
The agent has no identities.


$ ssh -vT git@github.com
[…]
debug1: Will attempt key: ED25519 SHA256:S5[…]8M agent
[…]
debug1: Offering public key: ED25519 SHA256:S5[…]8M agent
[…]
debug1: No more authentication methods to try.
git@github.com: Permission denied (publickey).

ED25519 SHA256:S5[…]8M key is the correct key

  1. Complete un-install → reboot → re-install is of no use (yes, all files in ~/Library)
  2. Moved all ssh keys out of and back into "Personal" vault (in personal account)

I've spent hours on this today…

Still not working 😕 going to bed