GNOME Bugzilla – Bug 642008
GNOME keyring allows the use of SSH keys that have weak file access permissions
Last modified: 2018-03-10 05:14:29 UTC
OpenSSH enforces that one's keys must be mode 0700 so that unsafe permissions do not go unnoticed. It would be nice if GNOME keyring could detect/correct this and take appropriate action.
Test case: 1. Set permissions of SSH key to unsafe: $ chmod 644 ~/.ssh/id_rsa 2. Log into a SSH server that uses this key $ ssh master.gnome.org (works) 3. Stop GNOME keyring $ killall gnome-keyring-daemon 4. Log into SSH server $ ssh master.gnome.org (fails, OpenSSH complains about permissions) @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Permissions 0644 for '/home/bob/.ssh/id_rsa' are too open. It is recommended that your private key files are NOT accessible by others. This private key will be ignored. bad permissions: ignore key: /home/bob/.ssh/id_rsa Permission denied (publickey).
Proposed solution: 1. GNOME keyring loads unsafe keys but marks them as such (this is because otherwise the user would not be able to tell why their keys aren't working) 2. When the user accesses the key, GNOME keyring puts up a dialog warning that the key is insecure. 3. The user has the option to cancel the use (default), fix the permissions, or ignore the warning. I'm having trouble finding if/how the information can be easily passed to the UI - any pointers?
Hmmm, implementing the warning dialog is tough. Ignoring these files, while printing warnings to the logs is easy, but like you said this is going to cause problems for users for whom this has worked so far. The code for loading the keys are in the ssh-store [1], the unlocking code in the wrap-layer [2], and the actual dialog in gnome-keyring-prompt [3]. [1] http://git.gnome.org/browse/gnome-keyring/tree/pkcs11/ssh-store/gkm-ssh-module.c#n104 [2] http://git.gnome.org/browse/gnome-keyring/tree/pkcs11/wrap-layer/gkm-wrap-layer.c#n700 [3] http://git.gnome.org/browse/gnome-keyring/tree/ui/gku-prompt-tool.c
Are you still interested in working on this? Perhaps a patch that might fix the permissions for ssh keys that have incorrect permissions?
gnome-keyring should just wrap stock ssh-agent to solve this problem: https://bugzilla.gnome.org/show_bug.cgi?id=775981
With bug 775981, the agent refuses signing request (although there is no warning shown).