Split ssh configuration fails in 4.3

[rrn]

I have a working split-ssh configuration for a long time. Recently, after upgrading to 4.3 with a clean install, and reapplying SshAgent policy in dom0,

I try this in the previously working appvm:

$ ssh -T git@github.com
sign_and_send_pubkey: signing failed for ED25519 "/home/user/.ssh/id_ed25519_github" from agent: agent refused operation
git@ssh.github.com: Permission denied (publickey).

in the meantime, my dom0 python popup appears and gets confirmation in the same way it did in 4.2. However, I see these line in my ssh backend:

qrexec-client-vm[940]: Unknown hint "sender-pid", ignoring
qrexec-client-vm[940]: Message sent to server
qrexec-client-vm[940]: 16 bytes read!
ssh-askpass[1607]: cannot open display: 

However, I can list ssh keys from the app vm (ssh client vm) and on the ssh backend vm correctly by using ssh-add -L.

[rrn]

@rrn

ssh-askpass[1607]: cannot open display:

This was due to the fact that the ssh-agent.service has SSH_ASKPASS_REQUIRE=force in its environment.
I have created an override for that, and the ssh-askpass no longer appears in the log, but the issue about split-ssh still persists.

[rrn]

Resolved by disabling and masking gcr-ssh-agent and using a non-gui ssh agent in the ssh backend (vault) vm instead.

[solene]

I understand that the current guide might require a change. Thanks for sharing the solution.

[wizard]

Hey,

just install package ksshaskpass in your ssh-vault VM (or template)

For my fedora-42-template work it:

doas dnf install ksshaskpass

[leni1]

@rrn

Resolved by disabling and masking gcr-ssh-agent and using a non-gui ssh agent in the ssh backend (vault) vm instead.

Could you share how exactly you went about doing this? I’ve tried to do this as mentioned here but I haven’t been able to figure out what was meant by “using a non-gui ssh agent in the ssh backend (vault) vm instead”.

[rrn]

Hi @leni1, There was a short time frame that this has worked on some RC version of 4.3. However, later on it stopped working due to some reason unknown t me, and therefore I have switched to using KeepAssXC on my vault machine.
That worked and I did not go back. The part of the guide on KeepAssXC is here:

Split SSH

Split SSH implements a concept similar to having a smart card with your private SSH keys, except that the role of the “smart card” is played by another Qubes AppVM. This Qubes setup allows you to keep your SSH private keys in a vault VM (vault) while using an SSH Client VM (ssh-client) to access your remote server. This is done by using Qubes’s qrexec framework to connect a local SSH Agent socket from your SSH Client VM to the SSH Agent socket within the vault VM. This way the compromise of the …

This offers a good experience as well. You just need to unlock the KeepAssXC upon boot.

The original idea was to disable the attempt to run the gui pinentry component IIRC. But it stopped working during the lifetime of the RCs.