ssh-agent: segfaults with gnome-keyring on removing a ssh key.

[mannp]

Expected Behavior

To be able to remove and add ssh keys at will.

Current Behavior

ssh-agent[11068]: segfaults.

Steps to Reproduce (for bugs)

1. Testing key gets added and is listed in ssh-add -l

2.When I select 'remove from agent' I get the following dmesg log;

ssh-agent[11068]: segfault at 0 ip 0000556c73f68923 sp 00007fd22b7fdb10 error 4 in gnome-keyring-daemon[556c73f21000+101000]

3. ....and ssh-add -l gives me;

Error connecting to agent: Connection refused

Debug Info

KeePassXC - Version 2.3.0-snapshot
Build Type: Snapshot
Revision: a06e85f

Libraries:

• Qt 5.10.1
• libgcrypt 1.8.2

Operating system: Arch Linux
CPU architecture: x86_64
Kernel: linux 4.15.6-1-ARCH

Enabled extensions:

• Auto-Type
• Browser Integration
• Legacy Browser Integration (KeePassHTTP)
• SSH Agent
• YubiKey

[hifi]

What type of key do you have, is it RSA and what is the bitness? Are you sure it's Gnome Keyring that KeePassXC is talking to because ssh-agent process is the OpenSSH one?

Could you paste the value of SSH_AUTH_SOCK environment variable from a terminal window you would launch KeePassXC from for testing purposes? You can check all SSH related environment variables with env | grep SSH.

[mannp]

To be honest no I am not entirely clear with the ssh-agent thing, as I have just started trying to set it up.

I have been using a dozen keys with a config file up to now and wanted to convert them all to using keepassxc.

Key is 4096 SHA256:(RSA) converted using your command here;

ssh-keygen -o -p -f id_rsa

It confused me that the keepassxc support is called ssh-agent support and not ssh-agent 'client' support as it appears to acting as a client rather than actually supplying ssh-agent functionaility? or have I misunderstood?

SSH_AUTH_SOCK=/run/user/1000/keyring/ssh

This is a standard gnome install on arch linux.

I have tried disabling gnome-keyring ssh support on my arch laptop and got myself into a mess, so this is a clean install of gnome on my desktop machine.

I very much appreciate your work and I know writing docs is tedious, but a minimum requirements for this functionaility would be cool 🥇

Edit: So some more reading on the arch wiki and it appears yes I am running the ssh daemon part of gnome-keyring, as executing the following gives me back a working ssh-agent;

gnome-keyring-daemon -r -d
** Message: Replacing daemon, using directory: /run/user/1000/keyring
GNOME_KEYRING_CONTROL=/run/user/1000/keyring
SSH_AUTH_SOCK=/run/user/1000/keyring/ssh

Edit2: Restarting the gnome keyring daemon give me a working ssh-agent again and I can list keys, but when removing an exisiting key it segfaults again.

Edit3: When selecting 'remove key' when there are no keys in the agent does not cause a segfault.

[hifi]

Thanks, that looks like GNOME Keyring indeed. I will try to reproduce the issue to see if there's something odd happening with it. There were crashing issues with ssh-agent process itself long before 2.3.0 was released but it was fixed but this may be related to the same thing.

You are correct that the agent feature is a client feature and not a server feature. It could be thought as "SSH Agent integration" rather than an agent itself.

[hifi]

@mannp Is it possible for you to test building from release/2.3.1 branch? There are RSA related fixed that might help.

[mannp]

@hifi just building the release/2.3.1 branch now, will report back shortly.

Edit: Ok it build and made but not sure how to create a standalone binary without make install on my production system, so likely to screw it up from here...

Is the RSA related fix you mention not in the master branch yet as I am using the git build on arch from the master branch.

[hifi]

Just type ./src/keepassxc in the build directory to run it.

I tested this against GNOME Keyring 3.27.4 on Ubuntu 18.04 and it didn't crash even with KeePassXC 2.3.0.

[mannp]

Mmh ok 2.3.1 branch executes with no errors but the gui doesn't show. Will need to look further, not sure whats happening.

Which version did you test, 2.3.0 and latest master git, as that is what I am using.

Perhaps an arch linux thing then as its a default install, using GNOME Keyring 3.27.4

[hifi]

Master branch equals the 2.3.0 release, you'd need to do something along these lines to get the 2.3.1 WIP branch:

git fetch origin release/2.3.1
git checkout -b release/2.3.1 origin/release/2.3.1

I will try to install Antegros later this week/weekend to replicate the crash if no one figures what's going on by then.

[mannp]

Thats what I have done and it built fine but the gui doesn't start and no errors appear.

I will delete and re-pull later this evening to see if the 2.3.1 branch sorts it out.

Edit: Deleted and rebuilt and still no gui.

Edit: Restored laptop gnome ssh agent and get the same segfault.

[hifi]

Got some time and installed Antegros with Cinnamon and could not reproduce. I took these steps:

1. Generate encrypted RSA key with default options by doing just ssh-keygen
2. Create new empty database
3. Create an entry with said key
4. Try to add/remove the key multiple times with the buttons on agent page

The key was successfully added and removed from GNOME Keyring and no segfault was happening. Checked the socket was set to /run/user/1000/keyring/ssh so it was definitely using the keyring agent. The version I have is 3.27.4+8+gff229abc-1 that was available from the repositories.

If you can reproduce this reliably, could you generate a key and configure a database in a way it definitely crashes your GNOME Keyring and share that database? I'm likely doing something wrong as I can't trigger it.

[mannp]

With the release of 2.3.1 I tried it again this morning and keepassxc reports the following error when trying to remove the key.

'Agent protocol error'

At this point the segfault occurs.

Any add or removal within kpxc results in;

'Agent connection failed'

Also, I converted the key and didn't create a new one and have 12 or so keys that likely need converting too.

Perhaps the conversion is causing the issue.

[hifi]

FYI if you don't need GNOME Keyring for anything else you can always use ssh-agent directly to sort out this issue for yourself. Also you don't need to convert any keys to use this feature unless they are too old that are completely unsupported.

I still don't know how to reproduce this myself so if you could create a test case database that definitely triggers the issue for you that you can share it would help with testing as then I could be sure that there's nothing wrong (or right) with my keys or testing methods.

[hifi]

@mannp @ToKaTpoHb I got this reproduced now with an empty comment. Does this occur if you set an username for the entry so that the comment is not empty when you do ssh-add -l?

That issue has been fixed in #1681 and it was only thought of affecting gpg-agent at the time. Can you guys please confirm if having a non-empty comment fixes GNOME Keyring crashes?

Thanks!

[Mirokko]

@hifi looks like keepassxc (snap) cant get comment from key. I've created key with ssh-keygen -t rsa -b 4096 -C "MyComment" and ...

[hifi]

@ToKaTpoHb The comment is only stored in the .pub file for RSA keys in the old (and default) format. If you want an embedded comment use ssh-keygen -o -t rsa -b 4096 -C "MyComment".

As I said before you can set the username for the entry to override an empty comment in 2.3.1 where the fix for empty comments is not yet landed.

[Mirokko]

@hifi Confirmed.

Do you need more information?

[hifi]

@ToKaTpoHb Is that still the snap install? Does the snap have a separate issue of not being able to connect regardless?

Does having a comment fix GNOME Keyring from crashing with the PPA version?

[Mirokko]

@hifi Yes, it is snap install. I have not found any related issues, even with "connect" as keyword. You can checkout it here

PPA version (KeePassXC - Version 2.3.1, Revision: 2fcaeea) not crashing right now, but...

Just a note: i dont have a segfault in snap, just error message. I can list keys after that.

Maybe i can debug that somehow?

[droidmonkey]

@hifi is this still an issue?

[hifi]

As far as I know, one issue was fixed and after GNOME Keyring replaced its internal agent with OpenSSH remaining issues should be OpenSSH related.

[droidmonkey]

Ok I'm labeling this upstream then.