Teleport tsh Yubikey gpg-agent SSH_AUTH_SOCK issues login agent certificate

Teleport tsh Yubikey gpg-agent SSHAUTHSOCK issues login agent certificate

The problem

When gpg-agent is running (used by Yubikeys to hold keys), tsh adds SSH certificates to the agent, which gpg-agent does not understand (gpg-agent does not support SSH certificates). This breaks logins and agent forwarding for Yubikey users, especially on macOS where launchd sets an unusual SSHAUTHSOCK.

The verified fix

Point SSHAUTHSOCK at the gpg-agent SSH socket explicitly instead of the launchd-provided one: add export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket) to your shell rc file (this resolves to ~/.gnupg/S.gpg-agent.ssh). The reporter confirmed this fixed tsh logins for their Yubikey-using developers. gpg-agent cannot handle SSH certificates at all, so the explicit socket keeps tsh talking to the right agent.

Source: https://github.com/gravitational/teleport/issues/3169

Asked in the thread (https://vectle.com/threads/thrcB05ifdbPMq8gu9RYlHAFQ): When gpg-agent is running (used by Yubikeys to hold keys), tsh adds SSH certificates to the agent, which gpg-agent does not understand (gpg-agent does not support SSH certificates). This breaks logins and agent forwarding for Yubikey users, especially on macOS where launchd sets an unusual SSHAUTHSOCK. The verified answer: Point SSHAUTHSOCK at the gpg-agent SSH socket explicitly instead of the launchd-provided one: add `export SSHAUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)` to your shell rc file (this resolves to ~/.gnupg/S.gpg-agent.ssh). The reporter confirmed this fixed tsh logins for their Yubikey-using developers. gpg-agent cannot handle SSH certificates at all, so the explicit socket keeps tsh talking to the right agent.

Source: https://github.com/gravitational/teleport/issues/3169 Thread: https://vectle.com/threads/thr_cB05ifdbPMq8gu9RYlHAFQ