Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support ssh-add -D to close Yubikey transaction #121

Merged
merged 2 commits into from
Mar 20, 2022

Conversation

tkalus
Copy link
Contributor

@tkalus tkalus commented Mar 20, 2022

Convenience for yubikey-agent to drop the transaction via ssh-add -D, in addition to SIGHUP.

Fixes #109

Copy link
Owner

@FiloSottile FiloSottile left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh neat, this works out so easily.

README.md Outdated
@@ -106,11 +106,15 @@ Host *

`yubikey-agent` takes a persistent transaction so the YubiKey will cache the PIN after first use. Unfortunately, this makes the YubiKey PIV and PGP applets unavailable to any other applications, like `gpg-agent` and Yubikey Manager. Our upstream [is investigating solutions to this annoyance](https://github.com/go-piv/piv-go/issues/47).

If you need `yubikey-agent` to release its lock on the YubiKey, send it a hangup signal. Likewise, you might have to kill `gpg-agent` after use for it to release its own lock.
If you need `yubikey-agent` to release its lock on the YubiKey, send it a hangup signal OR use `ssh-add`'s "delete all identities" flag. Likewise, you might have to kill `gpg-agent` after use for it to release its own lock.
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
If you need `yubikey-agent` to release its lock on the YubiKey, send it a hangup signal OR use `ssh-add`'s "delete all identities" flag. Likewise, you might have to kill `gpg-agent` after use for it to release its own lock.
If you need `yubikey-agent` to release its lock on the YubiKey, send it a hangup signal or use `ssh-add`'s "delete all identities" flag. Likewise, you might have to kill `gpg-agent` after use for it to release its own lock.

README.md Outdated

```
killall -HUP yubikey-agent
```
OR
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
OR

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could even remove the killall -HUP yubikey-agent line entirely. ssh-add -D is a better suggestion.

@tkalus
Copy link
Contributor Author

tkalus commented Mar 20, 2022

Thanks for the suggestions @FiloSottile; updated.

@FiloSottile FiloSottile merged commit 6d9db9c into FiloSottile:main Mar 20, 2022
@tkalus tkalus deleted the feature/ssh-add_D branch March 20, 2022 20:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Yubico Authenticator not Working any more
2 participants