support auto-adding ecdsa_sk and ed25519_sk keys
Brought to you by:
rosenauer
Menu
▾
▴
#4 support auto-adding ecdsa_sk and ed25519_sk keys
pam_ssh does not seem to support loading hardware-backed keys (ecdsa_sk and ed25519_sk). I have added such a key in both the .ssh/ and .ssh/login-keys.d/ directories along with three others of type id_rsa, id_ecdsa and id_ed25519. All four keys have the same passphrase.
When logging in with pam_ssh, the three others are unlocked and added to the ssh-agent session, but the ecdsa_sk one is not.
The key itself is in order, a manual "ssh-add id_ecdsa_sk" adds the key just fine.
I believe the code would need to be(come) aware of *_sk keys first. Can you confirm this is a missing feature?
Looking at the code, I do see ed25519_sk, but not ecdsa_sk, so my feature request reduces to ecdsa_sk support. ("I don't have a security key supporting ed25519_sk, you insensitive clod!") ;-)