YubiKey not working (device not found) in WSL while it works perfect under Windows directly

Question

I use Yubikey to connect to multiple servers. I am doing this under windows and this works perfectly fine with my sshconfig in the .ssh directory.

Now I have a case where I need to run some things under linux and connect to the same servers also using the YubiKey. So I installed WSL (Ubuntu) and copied my config and keys from my Windows SSH config to the WSL environment. SSH generally works fine when connection to a server thats only using a password or only a key file without YubiKey.

But every connection that requires the YubiKey fails with the following error (changed IPs and names for obvious reasons):

Confirm user presence for key ED25519-SK SHA256:BnVjcbhrBbURNA7KSkTI22C0Z9/6avSGpC72GbIvOJw
sign_and_send_pubkey: signing failed for ED25519-SK "/home/kgr/.ssh/keys/admin@server": device not found
[email protected]: Permission denied (publickey).

Sadly I could not find anything regarding the "device not found" that occurs here.

Any hints on what could causing this or are there some special steps that are required for WSL to use the YubiKey correctly?

EDIT: I forgot somethin to mention, since it made no difference:

I followed the article on https://levelup.gitconnected.com/how-to-use-a-yubikey-in-wsl2-linux-on-windows-96f176518583 but without success. Once I try to use any gpg commands in WSL, it says no such device, while it works in windows.

I also found comments online that the .bashrc entry has to point to the config in AppDataLocal since Gpg4win Version 4. But I also tried that and it made no difference.

EDIT2: after some helpful comments I could see my card with gpg --card-status in WSL. Anyhow the ssh connection still fails with the same error. One thing I noticed when running gpg --card-status is that the "Version" entry shows "0". Not sure how relevant this. Since currently everything seems to work but ssh fails, I am bit clueless.

Answer 1

The article How to Use a Yubikey in WSL2 (Linux) on Windows contains the required WSL2 setup.

Installation of required packages :

sudo apt update
sudo apt upgrade
sudo apt install socat iproute2
mkdir ~/.ssh
wget https://github.com/BlackReloaded/wsl2-ssh-pageant/releases/latest/download/wsl2-ssh-pageant.exe -O ~/.ssh/wsl2-ssh-pageant.exe
chmod +x ~/.ssh/wsl2-ssh-pageant.exe

Append the following to your ~/.bashrc file:

# SSH Socket
# Removing Linux SSH socket and replacing it by link to wsl2-ssh pageant socketexport SSH_AUTH_SOCK="$HOME/.ssh/agent.sock"
if ! ss -a | grep -q "$SSH_AUTH_SOCK"; then
  rm -f "$SSH_AUTH_SOCK"
  wsl2_ssh_pageant_bin="$HOME/.ssh/wsl2-ssh-pageant.exe"
  if test -x "$wsl2_ssh_pageant_bin"; then
    (setsid nohup socat UNIX-LISTEN:"$SSH_AUTH_SOCK,fork" EXEC:"$wsl2_ssh_pageant_bin" >/dev/null 2>&1 &)
  else
    echo >&2 "WARNING: $wsl2_ssh_pageant_bin is not executable."
  fi
  unset wsl2_ssh_pageant_bin
fi# GPG Socket
# Removing Linux GPG Agent socket and replacing it by link to wsl2-ssh-pageant GPG socketexport GPG_AGENT_SOCK="$HOME/.gnupg/S.gpg-agent"
if ! ss -a | grep -q "$GPG_AGENT_SOCK"; then
  rm -rf "$GPG_AGENT_SOCK"
  wsl2_ssh_pageant_bin="$HOME/.ssh/wsl2-ssh-pageant.exe"
  if test -x "$wsl2_ssh_pageant_bin"; then
    (setsid nohup socat UNIX-LISTEN:"$GPG_AGENT_SOCK,fork" EXEC:"$wsl2_ssh_pageant_bin --gpg S.gpg-agent" >/dev/null 2>&1 &)
  else
    echo >&2 "WARNING: $wsl2_ssh_pageant_bin is not executable."
  fi
  unset wsl2_ssh_pageant_bin
fi

Now restart WSL2:

wsl.exe --shutdown

To test the access to your YubiKey in WSL2 try gpg --card-status to get info about your yubikey.

To change key trustworthiness to ultimate :

$ gpg --edit-key 1CA87B39873495770098080098336BC4E5C445AB
gpg> trust
Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menuYour decision? 5
Do you really want to set this key to ultimate trust? (y/N) y
gpg> quit

If you now run gpg --list-keys the keys should have ultimate trust.

For more details, see the linked article.