Page MenuHome GnuPG

Intermittent ssh publickey login failure after upgrade to gnupg 2.5.x
Open, Needs TriagePublic

Description

I have a setup with gnupg acting as ssh agent and ssh key stored on YubiKey smart card. Ever since I've upgraded gnupg from 2.4.8 to 2.5.x I've started getting rare failures with ssh login. On the SSH side all looks fine -- keys are correctly discovered and offered by client, server accepts them but authentication fails. All ssh server has to say about this is:
debug1: child_reap: preauth child 7764 for connection from <IP1> to <IP2> exited after unsuccessful auth attempt
retrying login immediately succeeds.

I wasn't sure what to blame as other packages got updated too but today I've finally arrived at "eventual reproducer" which, given enough repetitions, reproduces the issues. After downgrading gnupg back to 2.4.8, I wasn't able to reproduce the issue anymore with total of 1500 ssh connections so I guess most likely culprit is somewhere in new gnupg. The issue seems to be very time sensitive, like some race, perhaps some communication channel is closed before all data was transferred?

Somewhat problematic part of this reproducer is that single pass consists of 100 connections established within 20 seconds, partly in parallel, which makes hard to correlate specific ssh invocation with log messages. Although to be fair I don't see any errors with "debug-log advanced" both in gpg-agent.conf and scdaemon.conf.

I fully realize the issue is scarce on details what might be wrong, but I would appreciate some ideas how could I diagnose it further.

Details

Version
2.5.18