4098 bits strikes again: pam-ssh-agent and an RSA key that was 2 bits too big

In August, I wrote about replacing security/pam-ssh-agent-auth with security/pam_ssh_agent. The old module is abandoned and deprecated. The new one, pam-ssh-agent, was a drop-in replacement in /usr/local/etc/pam.d/sudo: auth sufficient /usr/local/lib/pam_ssh_agent.so file=~/.ssh/authorized_keys I saw no problems with it, except when this one case. The symptom With an ssh-rsa key, sudo fell through to the next PAM entry, and this showed up in the logs: pam_ssh_agent(sudo:auth): authorized keys from '/usr/home/foo/.ssh/authorized_keys' pam_ssh_agent(sudo:auth): signature error: cryptographic error pam_ssh_agent(sudo:auth): pam_ssh_agent(sudo:auth): Caused by: pam_ssh_agent(sudo:auth): cryptographic error I changed to an ssh-ed25519 key. No problems. I wasn’t asking for a fix, merely confirmation that RSA was supported. I opened an issue and asked. The investigation nresare, the maintainer, confirmed RSA is expected to work, and showed a passing test with a freshly generated key. They…