Support for ED25519-SK keys

[Lucifer1903]

It seems there is no support for ED25519-SK Keys.

When using ED25519-SK keys pssh responds with "Exited with error code 255
Stderr: sign_and_send_pubkey: signing failed for ED25519-SK "/home/user/.ssh/id_ed25519_sk": invalid format
pssh error: SSH requested a password. Please create SSH keys or use
the -A option to provide a password."

Is there any chance that ED25519-SK key format support will be available in the future as this would be more secure?

[lilydjwg]

pssh invokes ssh for its work. Do you succeed if you do ssh target_host directly from the terminal?

[Lucifer1903]

Yes it works when I use "ssh target_host".

I think the issue is that ED25519-SK requires talking to a secure-key such as yubikey. Maybe pssh skips talking to the secure-key.

The certificate is "no-touch-required" and "no-touch-required" is set in authorized_keys it shouldn't be anything relating to requiring the secure key to be touched.

[lilydjwg]

What if you comment out this line:

pssh/psshlib/task.py

Line 88 in d4909c9

environ['SSH_ASKPASS'] = askpass_client.executable_path()

[Lucifer1903]

I don't think that will help.

I have figured out that if I set "-p 1" it works as hosts are connected to sequentially however it drastically increases the amount of time as host needs to finish before connecting to the next one.

I think the issue is that when establishing in parallel each host requests for the ssh key to be signed by the secure-USB however each new request cancels the previous request before the USB has time to finish processing it.

[lilydjwg]

It doesn't have some kind of lock to coordinate parallel requests?

[Lucifer1903]

Not that I know of. I'm using the Yubikey 5 nano.

https://www.yubico.com/us/product/yubikey-5-nano/