ssh: cannot access private key stored in TPM (private-dev) #6379
Comments
|
Instead of removing Proposal 1.
Proposal 2.
|
|
The |
Agreed.
That makes sense, though why not reuse Aren't they used for the same use case? Or is access to the tpm more critical than to u2f devices? |
That's the way forward, fully agree. I like |
When executing firejail directly, it's recommended to use the full path for the For example: |
|
Side note: The linked blog entree mentions Sadly I don't have hardware with a TPM (for now) to actually check what OP can do to support their setup with the 0.9.72 ssh.profile. |
|
I'm happy to be your testing monkey :) Just throw a config at me and I'll try. |
FWIW $ cat /etc/tpm2-tss/fapi-config.json
{
"profile_name": "P_ECCP256SHA256",
"profile_dir": "/etc/tpm2-tss/fapi-profiles/",
"user_dir": "~/.local/share/tpm2-tss/user/keystore",
"system_dir": "/var/lib/tpm2-tss/system/keystore",
"tcti": "",
"system_pcrs" : [],
"log_dir" : "/run/tpm2-tss/eventlog/",
"firmware_log_file": "/dev/null",
"ima_log_file": "/dev/null"
} |
|
So far, my However I always get the same error: I'm not sure why |
|
Guess ssh needs a few more libraries than |
|
Inspired by this comment, I extended Unfortunately this doesn't help much: |
|
Looks like I wouldn't mess with whitelisting in |
Note that whitelisting a path also enables whitelisting in its base directory, What is the output without any local modifications? Example: firejail --ignore='include ssh.local' --ignore='include globals.local' \
/usr/bin/ssh $hostAlso, if you use
See |
|
With no modification, SSH simply connects to the host: If I understand correctly the previous comments, allowing libraries to be loaded is better done using Then executing gives this: |
Be aware that [...]
# Enable or disable private-lib feature, default disabled
# private-lib no
[...]FYI: after So although technically on 0.9.72 you can use it, the option isn't actively supported any longer. If you use it, keep eyes on this option whenever a |
Modifying /usr/lib is rarely done and is likely not as tested, so unless you As for the other entries, the whitelisting in Though in /etc it is usually done with Try this in ssh.local: |
|
Ok, thanks for the explanation about private-lib and modifying /usr/lib. |
Looks like you need more from /etc than is currently allowed. Try adding $ cat .config/firejail/ssh.local
whitelist ${HOME}/.tpm2_pkcs11
whitelist ${HOME}/.ssh
private-etc group,login.defs,passwd,ssh,tpm2-tss |
|
OK I get a little further, but still no TPM |
|
I think U2F and TPMs share the same goal, but do not always come in the same form factor:
Binding the two in firejail would make it less flexible for the user to disable one without disabling the other, and currently now the source code relates U2F to USB devices: https://github.com/netblue30/firejail/blob/master/src/firejail/fs_dev.c#L92. So I think distinguishing them is a better approach. |
Sorry, in the previous comment I left out the default paths for There have been many changes to Also, does it work without
What is the output of the following commands? firejail --trace=trace.txt --ignore='include ssh.local' /usr/bin/ssh -vvv $host
firejail --trace=trace_local.txt /usr/bin/ssh -vvv $hostWhat is the output in trace.txt and trace_local.txt? |
I actually don't see any difference in the output with or without |
|
kmk3
pushed a commit
to qdii/firejail
that referenced
this issue
Jul 4, 2024
An ssh private key may be stored in a Trusted Platform Module (TPM) device and `private-dev` in ssh.profile currently breaks this use-case, as it does not keep tpm devices (see netblue30#6379). So add a new `notpm` command and keep tpm devices in /dev by default with `private-dev` unless `notpm` is used.
|
The original issue was about accessing the keys in the TPM, which should be As for issues arising from adding whitelisting, I'd suggest looking at the The libtss error messages unfortunately do not contain any paths, but it looks |
|
True, the issue at hand is solved, I'll try with trace, and open another issue if it persists. |
kmk3
pushed a commit
to qdii/firejail
that referenced
this issue
Jul 7, 2024
An ssh private key may be stored in a Trusted Platform Module (TPM) device and `private-dev` in ssh.profile currently breaks this use-case, as it does not keep tpm devices (see netblue30#6379). So add a new `notpm` command and keep tpm devices in /dev by default with `private-dev` unless `notpm` is used.
kmk3
pushed a commit
to qdii/firejail
that referenced
this issue
Jul 7, 2024
An ssh private key may be stored in a Trusted Platform Module (TPM) device and `private-dev` in ssh.profile currently breaks this use-case, as it does not keep tpm devices (see netblue30#6379). So add a new `notpm` command and keep tpm devices in /dev by default with `private-dev` unless `notpm` is used.
kmk3
pushed a commit
that referenced
this issue
Jul 9, 2024
An ssh private key may be stored in a Trusted Platform Module (TPM) device and `private-dev` in ssh.profile currently breaks this use-case, as it does not keep tpm devices (see #6379). So add a new `notpm` command and keep tpm devices in /dev by default with `private-dev` unless `notpm` is used.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
Security freaks like me do like to store their SSH private keys in protected places. Most laptops nowadays come with a TPM, which can store them (see https://jade.fyi/blog/tpm-ssh/ for instance).
Steps to Reproduce
Follow the configuration guide for ssh with TPM2 linked above
Add the following configuration in
ssh.localNote: the SSH connection is also broken without adding these lines, but for a different reasons (no access to
/dev/tpm0, no access to the libraries).Run
firejail ssh <some host>Expected behavior
A SSH connection is opened to the host.
Actual behavior
An error message appears and no connection is established.
Behavior without a profile
A SSH connection is established.
Environment
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
The text was updated successfully, but these errors were encountered: