gnome-keyring-prompt-3 getting stuck?

[Neek]

F15 from fresh install off LiveCD. I find that on fresh login my ssh agent situation is a bit confused.

I normally ssh-add my keys to the authentication agent, and then ssh to remote hosts without thinking too much about it. Recently, the ssh command has been hanging. Running with -vvv shows it stops at the point it should talk to gnome-keyring:

[neek ~]$ ssh -vvv neek@nickfenwick
OpenSSH_5.6p1, OpenSSL 1.0.0d-fips 8 Feb 2011
debug1: Reading configuration data /home/neek/.ssh/config
[cut ...]
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/neek/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 149
debug2: input_userauth_pk_ok: SHA1 fp xx:key:obscured:xx
debug3: sign_and_send_pubkey: RSA xx:key:obscured:xx
Error reading response length from authentication socket.
debug1: Offering RSA public key: id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 149
debug2: input_userauth_pk_ok: SHA1 fp xx:key:obscured:xx
debug3: sign_and_send_pubkey: RSA xx:key:obscured:xx

At that point it hangs and a ctrl-c will kill it.

The ssh-add command cannot connect to the ssh agent:

[neek ~]$ ssh-add -l
Could not open a connection to your authentication agent.

If I run to that ssh hang again, and this time grep ps for keyring:

[neek 110626]$ ps -aef | grep keyring
neek 1908 1 0 Jun26 ? 00:00:02 /usr/bin/gnome-keyring-daemon --start --components=pkcs11
neek 2101 1908 0 Jun26 ? 00:00:00 /usr/libexec/gnome-keyring-prompt-3
neek 27718 2441 0 10:14 pts/3 00:00:00 grep --color=auto keyring

I haven't had any gnome-keyring-prompt window appear on my desktop. Checking all workspaces, and using the Gnome 3 Overview screen to visually view open windows, doesn't show it. "kill -9 2101" returns the hung ssh attempt to the prompt immediately. Thinking about it, I don't believe I've had the Gnome 'enter your password to unlock your keyring' prompt once since installing F15.

I noticed that SSH_AUTH_SOCK seems a little confused:

[neek ~]$ gnome-keyring-daemon
GNOME_KEYRING_CONTROL=/tmp/keyring-rZXiXh
SSH_AUTH_SOCK=/tmp/keyring-rZXiXh/ssh
GPG_AGENT_INFO=/tmp/keyring-rZXiXh/gpg:0:1
GNOME_KEYRING_PID=28730
[neek ~]$ env | grep SSH
SSH_AUTH_SOCK=/tmp/keyring-xews3W/ssh

So it seems that gnome-keyring-daemon is using one tmp directory while my shell has been set up with another. If i manually set the SSH_AUTH_SOCK variable, things start working again:

[neek 110626]$ export SSH_AUTH_SOCK=/tmp/keyring-rZXiXh/ssh
[neek 110626]$ ssh-add -l
1023 xx:key:obscured:xx Public Key (RSA1)
1024 xx:key:obscured:xx /home/neek/.ssh/id_rsa (RSA)
1024 xx:key:obscured:xx id_rsa (RSA)

This is quite a pain, as I now have to reset SSH_AUTH_SOCK in every terminal I want to use the agent in.

What's the next best step to investigating why the gnome keyring prompt isn't appearing, and how the SSH_AUTH_SOCK variable is getting mismatched with the gnome-keyring-daemon's tmp dir?

Cheers
Nick

[Neek]

FWIW it just happened again. Clean boot. Run Netbeans and try to "Connect" to one of my stored databases. Normally I should get a gnome popup asking me to enter my password to unlock my keyring, but I get nothing. Netbeans GUI completely freezes up.

A quick check of the SSH_AUTH_SOCK value:

[neek ~]$ set | grep SSH
SSH_AUTH_SOCK=/tmp/keyring-Kf8hI7/ssh
[neek ~]$ gnome-keyring-daemon 
GNOME_KEYRING_CONTROL=/tmp/keyring-8rJzEh
SSH_AUTH_SOCK=/tmp/keyring-8rJzEh/ssh
GPG_AGENT_INFO=/tmp/keyring-8rJzEh/gpg:0:1
GNOME_KEYRING_PID=4847
[neek ~]$

So it seems it's wrong. Checking existence of gnome-keyring processes:

[neek ~]$ ps -aef | grep keyring
neek      1934     1  0 14:44 ?        00:00:00 /usr/bin/gnome-keyring-daemon --start --components=pkcs11
neek      2125  1934  0 14:44 ?        00:00:00 /usr/libexec/gnome-keyring-prompt-3
neek      4847     1  0 15:08 pts/3    00:00:00 gnome-keyring-daemon
neek      4979  4820  0 15:10 pts/3    00:00:00 grep --color=auto keyring

I've had no popups.

The last few lines of /var/log/messages (I don't know if the SELinux message is relevant. I'm running in Permissive mode because various things simply refused to run in Strict, that's another story):

Jun 28 14:58:07 uberneek dbus: [system] Activating service name='org.fedoraproject.Setroubleshootd' (using servicehelper)
Jun 28 14:58:09 uberneek dbus: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd'
Jun 28 14:58:14 uberneek setroubleshoot: SELinux is preventing /bin/systemd-tmpfiles from unlink access on the file patch-modules_v62.sh. For complete SELinux messages. run sealert -l 3a719c14-257d-462a-915c-c585d7ed8558
Jun 28 15:08:16 uberneek gnome-keyring-daemon[4847]: another secret service is running

I ran into some advice about gnome-keyring-daemon from last year (pre Gnome 3) that suggested "service gnome-keyring-daemon restart" might help, but I seem to have no such /etc/init.d script, and "systemctl list-units" doesn't include "keyring" anywhere in the output that I can see.

As before, I need to "kill -9 <pid>" the pid of the gnome-keyring-prompt-3 process. Then the "Enter your password to unlock your login keyring" dialog pops up and Netbeans comes back to life and connects to the database.

Nick