(best) Split SSH setup guide

User Support
56

I’m trying to setup Split SSH for git on a fresh installation of Qubes OS 4.2, but having trouble getting it to work. Like @haaber in #19443 and @mono in comment #38 of this topic, when executing ssh-add -L in the ssh-client VM I click the accept button in the dom0 Operation execution popup for qubes.SshAgent, but the ssh-client VM console prints error fetching identities: communication with agent failed regardless. Both the vault and the ssh-client VMs share the same fedora-38-xfce template that was installed when I installed the OS. First I followed the Split SSH setup guide and then tried virtually any combination of:

  1. Plain setup vs. KeePassXC
  2. @anyvm vs. real VM names in dom0 /etc/qubes-rpc/policy/qubes.SshAgent
  3. ask vs. ask,default_target=vault-VM-name in dom0 /etc/qubes-rpc/policy/qubes.SshAgent
  4. socat vs. ncat in TemplateVM /etc/qubes-rpc/qubes.SshAgent and ssh-client VM /rw/config/rc.local
  5. Trailing newline (comment #48 of this thread) in dom0 /etc/qubes-rpc/policy/qubes.SshAgent
  6. & character before or after the " character in ssh-client VM /rw/config/rc.local
  7. Renaming SSH_AUTH_SOCKET to SSH_SOCKET (to mirror the variable names used in other parts of the guide) in TemplateVM /etc/qubes-rpc/qubes.SshAgent and ssh-client VM ~/.bashrc

I suspect that I’m missing something, so I would like to know if someone got Split SSH working on Qubes OS 4.2.

The next issue is that git push seems to invoke gnome-ssh-askpass on fedora-38-xfce. I don’t know much about distros, but is gnome in xfce supposed to happen?

$ git push

error: unable to read askpass response from '/usr/libexec/openssh/gnome-ssh-askpass'

Username for 'https://...': <empty>

error: unable to read askpass response from '/usr/libexec/openssh/gnome-ssh-askpass'

Password for 'https://...': <empty>

remote: No anonymous write access.
fatal: Authentication failed.

Sorry for not linking to the topics and comments, new forum users are only allowed to post 2 links per post.