Yubikey Intermittently Hangs During Parallel Execution

[jlepere-everlaw]

• YubiKey Manager (ykman) version:5.5.1
• How was it installed?: Apt
• Operating system and version: Ubuntu 22.04
• YubiKey model and version: YubiKey 5C NFC FIPS v5.4.2
• Bug description summary: Yubikey intermittently hangs during parallel execution.

Steps to reproduce

My organization often runs ssh processes against different hosts in parallel using a yubikey for authentication to perform various tasks efficiently. Since upgrading workstations to Ubuntu 22.04, some of the parallel ssh processes have started failing/hanging intermittently. We've done some analysis and believe we're experiencing the same issue as described here.

We've tried upgrading from pcscd v2.0.3 from apt to pcscd v2.2.3 (v2.3.0 introduces a protocol mismatch - link) from source to no avail. We've also tried upgrading to Ubuntu 24.04.

Expected result

Successfully run ssh processes in parallel.

Actual results and logs

We've tried gathering logs as mentioned here, and while they're a little difficult to parse, we've been able to learn a couple of things. When trying to ssh into many hosts in parallel, the logs say multiple clients spin up. When things are healthy, the clients each BEGIN_TRANSACTION, TRANSMIT, and then END_TRANSACTION with healthy status codes. When we see the connection hanging issue, it's because remaining clients are receiving an error status code because of other outstanding connections, presumably because of some kind of deadlock situtation.

Other info

I understand this might not be within the scope of this repo, but hopefully someone else here has experienced this issue and could help point us in the right direction.

[klali]

Hello,

While I'm unsure if I can help directly I'd be very interested in the pcscd logs when this happens. Those in the linked bug report are a bit odd, there is a powerdown command sent to the YubiKey (0x63), then a new transfer without a corresponding powerup (0x62) before, resulting in a broken state.

If you don't want to share your pcscd log here you can email it to me ([email protected]).