When running `ssh-tpm-agent` with hierarchy no password is asked

[nikoslikius]

Environment:

• Ubuntu 26.04
• ssh-tpm-agent 0.9.0 installed with mise

I've set PIN on my TPM:

$ tpm2_getcap properties-variable | head
TPM2_PT_PERMANENT:
  ownerAuthSet:              1
  endorsementAuthSet:        0
  lockoutAuthSet:            1
  reserved1:                 0
  disableClear:              0
  inLockout:                 0
  tpmGeneratedEPS:           0
  reserved2:                 0
TPM2_PT_STARTUP_CLEAR:

I'm running this command with following output:

$ ssh-tpm-agent --hierarchy owner --owner-password --no-load -d
time=2026-07-08T12:12:47.171+03:00 level=INFO msg="Warning: ssh-tpm-agent is meant to run as a background daemon."
time=2026-07-08T12:12:47.171+03:00 level=INFO msg="Running multiple instances is likely to lead to conflicts."
time=2026-07-08T12:12:47.171+03:00 level=INFO msg="Consider using a systemd service."
time=2026-07-08T12:12:47.172+03:00 level=INFO msg="Listening on socket" path=/run/user/1000/ssh-tpm-agent.sock
time=2026-07-08T12:12:47.172+03:00 level=INFO msg="hierarchy key" algorithm=RSA hierarchy=owner
time=2026-07-08T12:12:47.176+03:00 level=INFO msg="TPM_RC_BAD_AUTH (session 1): authorization failure without DA implications"

No prompt for TPM PIN appears. No error about not installed ssh-askpass either.

I dig little into code, found hardcoded ssh-askpass paths and did following:

$ sudo apt install ssh-askpass-gnome
...
update-alternatives: using /usr/lib/openssh/gnome-ssh-askpass to provide /usr/bin/ssh-askpass (ssh-askpass) in auto mode
...

Because ssh-tpm-agent doesn't use global ssh-askpass path like:

$ which ssh-askpass
/usr/bin/ssh-askpass

I used the source hardcode like this:

sudo ln -sf /usr/lib/openssh/gnome-ssh-askpass /usr/lib/ssh/gnome-ssh-askpass

Still, I got the same error output when rerunning agent.

[nikoslikius]

Also I have another question: is it good idea to use PIN-protected owner-hierarchy ssh-keys for things like GitHub and etc.?
Or it is not intended use case of using ssh-tpm-agent?

Will be I also prompted for PIN each time ssh interaction action required?