FIDO2 auth against SSH server does not work - no touch interaction, window disappears.

Hello,

Thank you for contacting Devolutions Support and for the detailed log.

From the log, the server accepts your sk-ssh-ed25519 key and RDM starts the FIDO2 signing, but the YubiKey rejects the PIN step (PinAuthInvalid) before it gets to the touch request. That is why you are never asked to touch the key. We would like to reproduce this, so could you please help us with the following:

1. Which exact RDM for macOS version are you using (RDM > About)? If it is not the latest public version, please update and test again.

2. Which command did you use to create the key (for example ssh-keygen -t ed25519-sk with which -O options), and which ssh binary works in Terminal (output of "which ssh" and "ssh -V")?

3. In the SSH entry, under the SSH key tab, are you selecting the private key handle file created by ssh-keygen (the file without .pub)?

4. Is the PIN you type in RDM exactly the one you type in Terminal? If you have the YubiKey Manager installed, please send the output of "ykman fido info" (never share the PIN itself).

5. After testing with the latest version, please send a new session log with the SSH verbose level set to 2.

Once we have this, we will check it further and let you know.

Best regards,

1. I am on latest RDM 2026.3.1.2

2. ssh-keygen -C name -O application=ssh:user -O resident -O verify-required -f fileoutput

3. I have tried creating credential item in RDM itself where I pasted private key and public key generated by yubikey and also tried it directly setting on SSH host in SSH shell > ssh key section

4. yes, I am 100% sure pin is correct and I am entering it properly

fyi, to make it clear, by terminal I meant macOS terminal, connection to the server outside of RDM.

# ykman fido info
AAGUID:             GUID
PIN:                8 attempt(s) remaining
Minimum PIN length: 4

log using credential from RDM and directly on host > SSH settings show same:

[10/13/2026 9:27:04 PM] Devolutions.ProtocolsSharp: 2026.8.19.1 OS: macOS
[10/13/2026 9:27:04 PM] Terminal font: Menlo [Menlo, fixed=True]

[10/13/2026 9:27:04 PM] Starting SSH, verbose level: 2
[10/13/2026 9:27:04 PM] Setting up connection
[10/13/2026 9:27:04 PM] Connecting to: IP:22 (IPV_ANY)
[10/13/2026 9:27:04 PM] SSH version banner: SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u9

[10/13/2026 9:27:04 PM] Sending kex init
[10/13/2026 9:27:04 PM] Received kex init
[10/13/2026 9:27:04 PM] Selected algorithms: sntrup761x25519-sha512(strict), ssh-ed25519, chacha20-poly1305@openssh.com, chacha20-poly1305@openssh.com, implicit by cipher, implicit by cipher, none, none
[10/13/2026 9:27:04 PM] Sending sntrup x25519 kex init
[10/13/2026 9:27:04 PM] Received sntrup x25519 kex reply
[10/13/2026 9:27:04 PM] Successfully authentified server
[10/13/2026 9:27:04 PM] Sending new keys message
[10/13/2026 9:27:04 PM] Received new keys message
[10/13/2026 9:27:04 PM] Sending userauth service request
[10/13/2026 9:27:04 PM] Received extension info message
[10/13/2026 9:27:04 PM] Server accepts public key types: ssh-ed25519,sk-ssh-ed25519@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com,ssh-dss,ssh-rsa,rsa-sha2-256,rsa-sha2-512
[10/13/2026 9:27:04 PM] Received service accepted message
[10/13/2026 9:27:04 PM] Using provided key data
[10/13/2026 9:27:04 PM] Sending userauth init request
[10/13/2026 9:27:04 PM] Received userauth failure: publickey,password
[10/13/2026 9:27:04 PM] Starting public key authentication
[10/13/2026 9:27:04 PM] Validating public key: sk-ssh-ed25519@openssh.com
[10/13/2026 9:27:04 PM] Received userauth key ok
[10/13/2026 9:27:04 PM] Using CTAP2/FIDO2 for signing.
[10/13/2026 9:27:04 PM] FIDO2 user verification required.
[10/13/2026 9:27:09 PM] SSH session: FIDO2 PIN validation failed: PinAuthInvalid

Hello,

Thank you for the quick reply and for the ykman output.

From your log, the PIN is not rejected as wrong: your YubiKey still shows 8 attempts remaining, and PinAuthInvalid means the key refused the PIN authentication data that RDM sent, not the PIN itself. That is why you are never asked to touch the key. Your key was created with a custom application name (application=ssh:user), and we would like to rule that out as the trigger. Could you please try the following?

1. Create a new test key with the default application name, still with a PIN, for example:

  ssh-keygen -t ed25519-sk -O resident -O verify-required -f ~/.ssh/id_rdm_test

  Please check first that this new key works with ssh in Terminal.

2. In RDM, in the SSH entry, open the SSH key tab and load only the private key handle file (id_rdm_test, the file without .pub). Please do not paste the public key as well.

3. Connect and tell us whether the result is the same. If it still fails, please send a new session log with the SSH verbose level set to 2.

4. Please also send the output of "ykman info" (it shows the firmware version of your YubiKey; it does not contain any secret).

Once we have this, we will check it further and let you know.

Best regards,