GNOME Bugzilla – Bug 413278
Asks for SSH key passphrase although key is not in authorized_keys
Last modified: 2007-11-30 04:34:49 UTC
Hi, When connecting to a server where the public key is not put in the authorized keys, the passphrase dialog shows up, while the key won't be used. After failing to use the key (and bothering the user with the passphrase) ssh asks for the password. Without seahorse as an agent, ssh doesn't ask for the passphrase in such a situation. Bye Debian Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=409633
Yes this is a problem. The seahorse SSH agent is currently a proxy for the normal ssh-agent and when it detects that: a) ssh-agent has no keys loaded b) ssh wants some key It tries to load all the keys. This is clearly suboptimal however it'll be hard to fix in the near term. Eventually we need to rethink how the SSH agent support is done and make it far more fine grained.
I'm not sure if I should file a seperate bug about it. The problem I see is that seahorse should not popup a GUI passphrase dialog when using ssh at the command line. Today, after typing "ssh someserver.tld" in gnome-terminal, I could not see the dialog (maybe it was invisible, maybe it was just below the console window) and I couldn't move any windows or Alt+TAB. Pressing ESC helped. Seahorse has been holding the keyboard/mouse grab at the moment. However, my point is not the actual bug of not having the dialog displayed properly but that seahorse should not interfere with cli in the first place.
Christof, you can turn off this behavior under the capplet 'Encryption Preferences' on the tab 'Passphrase Cache'
*** Bug 430922 has been marked as a duplicate of this bug. ***
I guess the following bug has the same cause: http://bugs.debian.org/431544 If ssh-add -l is called from the console, then seahorse tries to add all keys available in standard locations. That is considered bad behaviour cause ssh-add -l would not do this under normal conditions. This behaviour does only occur if seahorse is configured to automatically load secure shell keys. Better behaviour would be to add keys only if using them (e.g. ssh or scp to a machine).
Josselin, thanks for adding the Debian bug. That's something I can probably track down.
The problem is the that seahorse-agent's SSH support is quick fix hack (mea culpa). I'm currently implementing a proper SSH agent in gnome-keyring-daemon as part of the PKCS#11 key/certificate work. So this problem will go away by GNOME 2.22 (which is when the key/certificate store will be included in gnome-keyring).
gnome-keyring now has real SSH agent support in trunk. http://live.gnome.org/GnomeKeyring/Ssh I'll go ahead and remove the SSH agent support from seahorse-agent. How does that sound Adam?
Sounds good to me. Does this result in having an extra daemon running or will it still just be gnome-keyring-daemon, seahorse-agent and seahorse-daemon?
The hack that was once seahorse's SSH agent (really a proxy) has been laid to rest. A new proper SSH agent is available in gnome-keyring trunk (will be in 2.21.3) and I'd love feedback on it if anyone feels so inclined. 2007-11-29 Stef Walter <stef@memberwebs.com> * agent/Makefile.am: * agent/seahorse-agent.h: * agent/seahorse-agent-main.c: * agent/seahorse-agent-ssh.c: * agent/seahorse-agent-status.c: * data/seahorse.schemas.in: * libseahorse/seahorse-passphrase.c: * libseahorse/seahorse-prefs.glade: * libseahorse/seahorse-prefs-cache.c: Remove SSH agent, since a proper one now exists in gnome-keyring. Fixes bug #413278 seahorse-agent still has a GPG agent running in it, but I think that in the future that can be migrated to gnome-keyring-daemon. Doing that will allow better integration with the users login and session keyrings. Then we can have one less daemon for keys and passwords.
As long as it's still possible to let the GPG key passwords be cached for a configured amount of minutes and have this configured separately from the SSH/other passwords I don't see a reason to not move the GPG password caching to gnome-keyring-daemon ;) But I definitely don't want my GPG key passphrase to be cached at login time...