Unable to login with lpass cli

[float0n]

When running lpass login john@doe.com, I get Error: SSL peer certificate or SSH remote key was not OK.

It appears the SSL certificate was updated earlier today, could this be related?

#540 seems related

[NikitaCOEUR]

Hi, Same here.
It's seems that certificate's thumbrint are stored here : https://github.com/lastpass/lastpass-cli/blob/master/pins.h

May be, you can update theses informations ?

[qharouff]

I am also suddenly seeing this issue.

[aha-sage]

Hi, Same here. It's seems that certificate's thumbrint are stored here : https://github.com/lastpass/lastpass-cli/blob/master/pins.h

May be, you can update theses informations ?

Hello! Just for clarification, the maintainer is the one responsible for updating pins.h, correct? It's not something we, as users, can modify ourselves to resolve the issue, is it?

[NikitaCOEUR]

Hi, Same here. It's seems that certificate's thumbrint are stored here : https://github.com/lastpass/lastpass-cli/blob/master/pins.h

May be, you can update theses informations ?

Hello! Just for clarification, the maintainer is the one responsible for updating pins.h, correct? It's not something we, as users, can modify ourselves to resolve the issue, is it?

We might be able to gather the missing information by retrieving the fingerprints of each certificate and modifying the relevant file through a pull request.
However, rebuilding the program and releasing the new version will still need to be done by the maintainers. Moreover, I believe they have all the necessary information in their possession. It remains to be seen how responsive they can be.

[nowakca]

I did extract a pin from the cert presented to me using (echo | openssl s_client -servername lastpass.com -connect lastpass.com:443| openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64) 2>&1 | tail -1 , popped that in a local copy of pins.h, rebuilt, and was able to log in.

So this really does look to be problem.

[darmstrong8008]

@NikitaCOEUR They do seem fairly responsive - my phonecall to support referred me to this issue tracker :D

[NikitaCOEUR]

I've just opened a support ticket via the portal for them to look into it...

[stfnhh]

I just got off the phone with support, extremely unhelpful they simply said "We don't support this" no explanation as to why or any other information.

[aha-sage]

I did extract a pin from the cert presented to me using (echo | openssl s_client -servername lastpass.com -connect lastpass.com:443| openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64) 2>&1 | tail -1 , popped that in a local copy of pins.h, rebuilt, and was able to log in.

So this really does look to be problem.

I'm trying to find the file pins.h after installing the lastpass-cli, but I couldn't find it. Could you please add more details about where we should edit?

[stfnhh]

@aha-sage you need to pull down the repo and build it.

[darmstrong8008]

I did extract a pin from the cert presented to me using (echo | openssl s_client -servername lastpass.com -connect lastpass.com:443| openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64) 2>&1 | tail -1 , popped that in a local copy of pins.h, rebuilt, and was able to log in.
So this really does look to be problem.

I'm trying to find the file pins.h after installing the lastpass-cli, but I couldn't find it. Could you please add more details about where we should edit?

You'll have to build from source by cloning this repo first.

[stfnhh]

build instructions on a mac, you may need to run brew install cmake

git clone https://github.com/lastpass/lastpass-cli.git
cd lastpass-cli
(echo | openssl s_client -servername lastpass.com -connect lastpass.com:443| openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64) 2>&1 | tail -1
# edit pins.h, prepend the results of the command above
make
mv build/lpass /usr/local/bin/lpass

[GavinKingstonCL]

I am getting this error after updating the pins.h and attempting to run make to build

CMake Error at /usr/local/Cellar/cmake/3.27.4/share/cmake/Modules/FindPackageHandleStandardArgs.cmake:230 (message): Could NOT find PkgConfig (missing: PKG_CONFIG_EXECUTABLE) Call Stack (most recent call first): /usr/local/Cellar/cmake/3.27.4/share/cmake/Modules/FindPackageHandleStandardArgs.cmake:600 (_FPHSA_FAILURE_MESSAGE) /usr/local/Cellar/cmake/3.27.4/share/cmake/Modules/FindPkgConfig.cmake:99 (find_package_handle_standard_args) CMakeLists.txt:10 (find_package)

[qharouff]

Steps to remediate (I'm on macOS):

1. Download the lpass-cli repository locally.
2. In a Terminal window, run cd [directory] [directory] being the path of the downloaded repository.
3. Modify the pins.h file within the folder to include the base64 output of @nowakca's suggested command. (echo | openssl s_client -servername lastpass.com -connect lastpass.com:443| openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64) 2>&1 | tail -1
4. Within the lpass-cli directory, run make from Terminal.
5. Look in the "build" folder created for a new "lpass" executable.

Note: on macOS, I received the following error:

"/bin/sh: cmake: command not found
make: *** [build/Makefile] Error 127"

Which was resolved by installing cmake using Brew: brew install cmake