PIV smartcard (PKS11) authentication hasn't worked since version 9.1.3

[jjdmon]

I use Cyberduck to connect to multiple Linux (RHEL) servers using PKS11 authentication with a smart card. The card is added to my keychain with a shell command: ssh-add -s /usr/lib/ssh-keychain.dylib. The entries for the servers in .ssh/config look like this:

Host myhost
  Hostname 123.456.789.10
  ServerAliveInterval 30
  ServerAliveCountMax 10
  IPQoS=throughput
  AddKeysToAgent yes
  ForwardAgent yes
  PKCS11Provider /usr/lib/ssh-keychain.dylib
  PreferredAuthentications publickey

I can connect to them with ssh via command line and with Cyberduck version 9.1.3. All versions of Cyberduck after that prompt for a username and password. I do see an option to select an ssh key file, but not the key on the card. This has broken before but it usually works again in the next version. Now it's been broken for a while. I checked the ~/Library/Logs/Cyberduck/cyberduck.log file after a failed connection and it was empty.

[dkocher]

We never had support for the PKCS11Provider directive but if you either select corresponding public key for the identity added to the agent in the bookmark or specify with the IdentityFile directive in your OpenSSH configuration, it should be possible to authenticate using the SSH agent ¹.

Footnotes

1. https://docs.cyberduck.io/protocols/sftp/#public-key-authentication-using-ssh-agent ↩

[jjdmon]

I don't see a way to do that. The key is not in a file, it's on the smartcard and added to the keychain. I've looked at the options in the bookmark and as far as I can see I can only select keys in files and the client certificate option is disabled. It works in Cyberduck 9.1.3 and does not work in any version after, so this method of authentication was supported at some point, intentionally or otherwise.

[jjdmon]

Could this be related to this issue: Does not read SSH key from SSH agent #17602

[dkocher]

Let me know if you can reproduce in the current snapshot build which has #17603.

[jjdmon]

I updated to the current snapshot (9.3.0, 44000) and PIV (PKS11) authentication is working again.