3:26 p.m.
When I run ssh-add, a gnome dialog pops up asking me for the password to
my private ssh key.
I find this a little odd, since I am not running ssh to connect
anywhere.
I also find this a little disconcerting: I don't like giving my private
key's to programs that ask for it.
Is anyone else experiencing this?
3:29 p.m.
On Thu, 2009-01-08 at 22:26 +0100, nodata wrote:
When I run ssh-add, a gnome dialog pops up asking me for the password
to
my private ssh key.
I find this a little odd, since I am not running ssh to connect
anywhere.
I also find this a little disconcerting: I don't like giving my private
key's to programs that ask for it.
Is anyone else experiencing this?
It's asking to store the passphrase in your gnome-keyring as
gnome-keyring is acting as an ssh-agent for you.
--
Jesse Keating
Fedora -- Freedom² is a feature!
identi.ca: http://identi.ca/jkeating
3:31 p.m.
nodata <lsof(a)nodata.co.uk> wrote:
When I run ssh-add, a gnome dialog pops up asking me for the password
to
my private ssh key.
That is the idea... it keeps the password for you, so you don't need to
enter it each time you connect to a site.
I find this a little odd, since I am not running ssh to connect
anywhere.
Then why using ssh-add(1)?!
I also find this a little disconcerting: I don't like giving my
private
key's to programs that ask for it.
Neither do I, but this one is _meant_ to do so.
Is anyone else experiencing this?
Everyday here.
--
Dr. Horst H. von Brand User #22616 counter.li.org
Departamento de Informatica Fono: +56 32 2654431
Universidad Tecnica Federico Santa Maria +56 32 2654239
Casilla 110-V, Valparaiso, Chile 2340000 Fax: +56 32 2797513
3:42 p.m.
Am Donnerstag, den 08.01.2009, 18:31 -0300 schrieb Horst H. von Brand:
nodata <lsof(a)nodata.co.uk> wrote:
> When I run ssh-add, a gnome dialog pops up asking me for the password to
> my private ssh key.
That is the idea... it keeps the password for you, so you don't need to
enter it each time you connect to a site.
But I am already using ssh-agent to do this.
> I find this a little odd, since I am not running ssh to connect
> anywhere.
Then why using ssh-add(1)?!
To add my key to ssh-agent.
> I also find this a little disconcerting: I don't like giving my private
> key's to programs that ask for it.
Neither do I, but this one is _meant_ to do so.
But can't I chose which program stores my key? I'd rather something with
less code stores it.
> Is anyone else experiencing this?
Everyday here.
3:48 p.m.
2009/1/8 nodata <lsof(a)nodata.co.uk>:
Am Donnerstag, den 08.01.2009, 18:31 -0300 schrieb Horst H. von
Brand:
But can't I chose which program stores my key? I'd rather something with
less code stores it.
By default this is set:
SSH_ASKPASS=/usr/libexec/openssh/gnome-ssh-askpass
so
unset SSH_ASKPASS
will get you what you want, I think.
HTH.
J.
ps. these sorts of questions should really be posted to the
fedora-list, not here.
2:32 a.m.
Hi.
On Thu, 8 Jan 2009 21:48:49 +0000, Jonathan Underwood wrote:
By default this is set:
SSH_ASKPASS=/usr/libexec/openssh/gnome-ssh-askpass
For the record: /usr/libexec/openssh/gnome-ssh-askpass is _not_ the program
popping up when ssh-add is run from an xterm. It seems like the ssh-agent
program (which is not the classical ssh-agent anymore, but a part of gnome)
is doing this on it's own, which explains why it does not care about being
called from a terminal or not.
5:12 a.m.
2009/1/9 Ralf Ertzinger <fedora(a)camperquake.de>:
Hi.
On Thu, 8 Jan 2009 21:48:49 +0000, Jonathan Underwood wrote:
> By default this is set:
>
> SSH_ASKPASS=/usr/libexec/openssh/gnome-ssh-askpass
For the record: /usr/libexec/openssh/gnome-ssh-askpass is _not_ the program
popping up when ssh-add is run from an xterm. It seems like the ssh-agent
program (which is not the classical ssh-agent anymore, but a part of gnome)
is doing this on it's own, which explains why it does not care about being
called from a terminal or not.
I never said it was :) I just said unset it, and the behaviour reverts.
3:54 p.m.
On 2009-01-08 10:42:28 PM, nodata wrote:
> Then why using ssh-add(1)?!
To add my key to ssh-agent.
>
> > I also find this a little disconcerting: I don't like giving my private
> > key's to programs that ask for it.
>
> Neither do I, but this one is _meant_ to do so.
But can't I chose which program stores my key? I'd rather something with
less code stores it.
From the ssh-add manpage:
DISPLAY and SSH_ASKPASS
If ssh-add needs a passphrase, it will read the passphrase from
the current terminal if it was run from a terminal. If ssh-add
does not have a terminal associated with it but DISPLAY and
SSH_ASKPASS are set, it will execute the program specified by
SSH_ASKPASS and open an X11 window to read the passphrase. This
is particularly useful when calling ssh-add from a .xsession or
related script. (Note that on some machines it may be necessary
to redirect the input from /dev/null to make this work.)
Perhaps the dialog that pops up is the program specified by your
SSH_ASKPASS environmental variable? I'm pretty sure that this is only
for prompting, and the passphrase still only gets stored by ssh-agent.
Thanks,
Ricky
4:02 p.m.
Am Donnerstag, den 08.01.2009, 16:54 -0500 schrieb Ricky Zhou:
On 2009-01-08 10:42:28 PM, nodata wrote:
> > Then why using ssh-add(1)?!
>
> To add my key to ssh-agent.
>
> >
> > > I also find this a little disconcerting: I don't like giving my
private
> > > key's to programs that ask for it.
> >
> > Neither do I, but this one is _meant_ to do so.
>
> But can't I chose which program stores my key? I'd rather something with
> less code stores it.
From the ssh-add manpage:
DISPLAY and SSH_ASKPASS
If ssh-add needs a passphrase, it will read the passphrase from
the current terminal if it was run from a terminal. If ssh-add
does not have a terminal associated with it but DISPLAY and
SSH_ASKPASS are set, it will execute the program specified by
SSH_ASKPASS and open an X11 window to read the passphrase. This
is particularly useful when calling ssh-add from a .xsession or
related script. (Note that on some machines it may be necessary
to redirect the input from /dev/null to make this work.)
Perhaps the dialog that pops up is the program specified by your
SSH_ASKPASS environmental variable? I'm pretty sure that this is only
for prompting, and the passphrase still only gets stored by ssh-agent.
Thanks,
Ricky
I'm wondering when this changed (F10)? I'm sure it didn't act like this
in F9.
In F9, I would only be prompted to enter my passphrase if I sshed to a
box that accepted pubkey authentication and a ssh-agent did not already
have the key.
In F10 it asks earlier: when ssh-add is run.
But oh well, it does.
4:21 p.m.
On 2009-01-08 11:02:14 PM, nodata wrote:
I'm wondering when this changed (F10)? I'm sure it didn't
act like this
in F9.
In F9, I would only be prompted to enter my passphrase if I sshed to a
box that accepted pubkey authentication and a ssh-agent did not already
have the key.
In F10 it asks earlier: when ssh-add is run.
When you run ssh-add, you are *asking*
for the passphrase to be stored
with ssh-agent, so of course, it has to ask for your passphrase. This
is the very purpose of ssh-add. Could you be confusing ssh-add with
something else?
Thanks,
Ricky
4:42 p.m.
Am Donnerstag, den 08.01.2009, 17:21 -0500 schrieb Ricky Zhou:
On 2009-01-08 11:02:14 PM, nodata wrote:
> I'm wondering when this changed (F10)? I'm sure it didn't act like this
> in F9.
>
> In F9, I would only be prompted to enter my passphrase if I sshed to a
> box that accepted pubkey authentication and a ssh-agent did not already
> have the key.
> In F10 it asks earlier: when ssh-add is run.
When you run ssh-add, you are *asking* for the passphrase to be stored
with ssh-agent, so of course, it has to ask for your passphrase. This
is the very purpose of ssh-add. Could you be confusing ssh-add with
something else?
No, I'm just getting annoyed that a GUI is popping up when I am using a
command line app. Not sure of the point of it, it seems counter
intuitive.
4:59 p.m.
On Thu, 2009-01-08 at 23:42 +0100, nodata wrote:
No, I'm just getting annoyed that a GUI is popping up when I am using a
command line app. Not sure of the point of it, it seems counter
intuitive.
You're using a command line app from a graphical terminal.
Also, cli apps aren't the only use for ssh and ssh keys.
--
Jesse Keating
Fedora -- Freedom² is a feature!
identi.ca: http://identi.ca/jkeating
5:42 p.m.
On Thu, Jan 08, 2009 at 05:59:57PM -0500, Jesse Keating wrote:
On Thu, 2009-01-08 at 23:42 +0100, nodata wrote:
>
> No, I'm just getting annoyed that a GUI is popping up when I am using a
> command line app. Not sure of the point of it, it seems counter
> intuitive.
You're using a command line app from a graphical terminal.
Not a very appealing argument... The 'graphical terminal' is a
terminal emulator, not something fancy, just a console with a
shell in it...
Also, cli apps aren't the only use for ssh and ssh keys.
But can't graphical applications simply ask the ssh-agent? Is the
graphical ssh-add frontend doing more than the cli ssh-add?
I was also quite freakened out by ssh-add popping a box of an unknown
application when I did a ssh-add in a terminal of a liveCD.
--
Pat
5:46 p.m.
Jesse Keating wrote:
On Thu, 2009-01-08 at 23:42 +0100, nodata wrote:
> No, I'm just getting annoyed that a GUI is popping up when I am using a
> command line app. Not sure of the point of it, it seems counter
> intuitive.
You're using a command line app from a graphical terminal.
...but according to Ricky Zhou:
From the ssh-add manpage:
DISPLAY and SSH_ASKPASS
If ssh-add needs a passphrase, it will read the passphrase from
the current terminal if it was run from a terminal.
...so shouldn't it use the terminal in this case? (isatty() thinks
Konsole and xterm are terminals, at any rate.)
--
Matthew
Please do not quote my e-mail address unobfuscated in message bodies.
--
We apologize for the inconvenience. -- God's Last Message to Creation
(as reported by Douglas Adams in the Hitchhiker's Guide series)
8:16 a.m.
On Thu, Jan 08, 2009 at 05:59:57PM -0500, Jesse Keating wrote:
On Thu, 2009-01-08 at 23:42 +0100, nodata wrote:
>
> No, I'm just getting annoyed that a GUI is popping up when I am using a
> command line app. Not sure of the point of it, it seems counter
> intuitive.
You're using a command line app from a graphical terminal.
I'm not sure I see your point. Changing focus to another window just
to type a passphrase seems at best to add zero benefit and at worst
to provide surprise and distraction. What is the benefit?
Also, cli apps aren't the only use for ssh and ssh keys.
Is this an either/or situation? The cited man page would seem to
indicate that GUI apps can use this feature while CLI invocations
should not. FWIW, that would seem to me to be the "least surprise"
behavior.
John
--
John W. Linville
linville(a)redhat.com
9:22 a.m.
On Fri, 2009-01-09 at 09:16 -0500, John W. Linville wrote:
Is this an either/or situation? The cited man page would seem to
indicate that GUI apps can use this feature while CLI invocations
should not. FWIW, that would seem to me to be the "least surprise"
behavior.
*shrug* I'm not claiming that there isn't a bug, I just didn't
investigate much. It seemed to work just like calling a
system-config-foo app from a graphical terminal, it'll launch the gui
version. It didn't exactly strike me as odd that the ssh passphrase
came up as a gui. I just like that it works automatically, I don't have
to manually call ssh-add.
--
Jesse Keating
Fedora -- Freedom² is a feature!
identi.ca: http://identi.ca/jkeating
10:19 a.m.
On Fri, 2009-01-09 at 09:16 -0500, John W. Linville wrote:
On Thu, Jan 08, 2009 at 05:59:57PM -0500, Jesse Keating wrote:
> On Thu, 2009-01-08 at 23:42 +0100, nodata wrote:
> >
> > No, I'm just getting annoyed that a GUI is popping up when I am using a
> > command line app. Not sure of the point of it, it seems counter
> > intuitive.
>
> You're using a command line app from a graphical terminal.
I'm not sure I see your point. Changing focus to another window just
to type a passphrase seems at best to add zero benefit and at worst
to provide surprise and distraction. What is the benefit?
http://man.root.cz/1/gnome-ssh-askpass/
gnome-ssh-askpass will lock keyboard focus to its window, preventing
focus stealing and key logging attacks from other X clients. It also
aborts if it fails to gain a lock on the keyboard. Try starting two
copies of gnome-ssh-askpass at the same time, and see what happens:
$ /usr/libexec/openssh/gnome-ssh-askpass&/usr/libexec/openssh/gnome-ssh-askpass
Seems to me it's much preferable to use gnome-ssh-askpass if you're in
X, even in xterms.
(Getting real sick of these "I vote to change default functionality
because I find it aesthetically displeasing and clearly I know better
than the people who designed and implemented the functionality"
threads.)
10:26 a.m.
On Fri, Jan 09, 2009 at 10:19:12AM -0600, Callum Lerwick wrote:
On Fri, 2009-01-09 at 09:16 -0500, John W. Linville wrote:
> On Thu, Jan 08, 2009 at 05:59:57PM -0500, Jesse Keating wrote:
> > On Thu, 2009-01-08 at 23:42 +0100, nodata wrote:
> > >
> > > No, I'm just getting annoyed that a GUI is popping up when I am using
a
> > > command line app. Not sure of the point of it, it seems counter
> > > intuitive.
> >
> > You're using a command line app from a graphical terminal.
>
> I'm not sure I see your point. Changing focus to another window just
> to type a passphrase seems at best to add zero benefit and at worst
> to provide surprise and distraction. What is the benefit?
http://man.root.cz/1/gnome-ssh-askpass/
gnome-ssh-askpass will lock keyboard focus to its window, preventing
focus stealing and key logging attacks from other X clients. It also
aborts if it fails to gain a lock on the keyboard. Try starting two
copies of gnome-ssh-askpass at the same time, and see what happens:
$ /usr/libexec/openssh/gnome-ssh-askpass&/usr/libexec/openssh/gnome-ssh-askpass
Seems to me it's much preferable to use gnome-ssh-askpass if you're in
X, even in xterms.
That could be -- the key logging point seems worthwhile. Thanks for
the explanation.
(Getting real sick of these "I vote to change default
functionality
because I find it aesthetically displeasing and clearly I know better
than the people who designed and implemented the functionality"
threads.)
I suspect some of us are a bit sick of the indignation we get from
others who don't think we should bother asking questions of them
because clearly they know best...just sayin'...
John
--
John W. Linville
linville(a)redhat.com
10:27 a.m.
On Fri, Jan 09, 2009 at 10:19:12AM -0600, Callum Lerwick wrote:
http://man.root.cz/1/gnome-ssh-askpass/
gnome-ssh-askpass will lock keyboard focus to its window, preventing
focus stealing and key logging attacks from other X clients. It also
aborts if it fails to gain a lock on the keyboard. Try starting two
copies of gnome-ssh-askpass at the same time, and see what happens:
$ /usr/libexec/openssh/gnome-ssh-askpass&/usr/libexec/openssh/gnome-ssh-askpass
Seems to me it's much preferable to use gnome-ssh-askpass if you're in
X, even in xterms.
Note that the dialog in this case comes from gnome-keyring, and is not
actually gnome-ssh-askpass. You can tell because gnome-ssh-askpass
doesn't offer to store things in your keyring, and it isn't used when
the process has access to a terminal device which it can use to prompt
the user.
Nalin
10:58 a.m.
On Fri, 2009-01-09 at 11:27 -0500, Nalin Dahyabhai wrote:
On Fri, Jan 09, 2009 at 10:19:12AM -0600, Callum Lerwick wrote:
> http://man.root.cz/1/gnome-ssh-askpass/
>
> gnome-ssh-askpass will lock keyboard focus to its window, preventing
> focus stealing and key logging attacks from other X clients. It also
> aborts if it fails to gain a lock on the keyboard. Try starting two
> copies of gnome-ssh-askpass at the same time, and see what happens:
>
> $ /usr/libexec/openssh/gnome-ssh-askpass&/usr/libexec/openssh/gnome-ssh-askpass
>
> Seems to me it's much preferable to use gnome-ssh-askpass if you're in
> X, even in xterms.
Note that the dialog in this case comes from gnome-keyring, and is not
actually gnome-ssh-askpass. You can tell because gnome-ssh-askpass
doesn't offer to store things in your keyring, and it isn't used when
the process has access to a terminal device which it can use to prompt
the user.
Any GUI password dialog really ought to be taking the same precautions.
... gnome-keyring's SSH agent doesn't seem to be working right on my
system. I've been using "keychain" but it should be disabled at the
moment.
Does it really implement its own ssh agent? That would be really
annoying as that would break interoperability with non-GUI logins. I ssh
in and use screen on this box as well. "keychain" was handling all cases
seamlessly, with this small fix:
ln -s /etc/profile.d/keychain.sh /etc/X11/xinit/xinitrc.d/keychain.sh
( https://bugzilla.redhat.com/show_bug.cgi?id=180776 )
6:56 p.m.
Callum Lerwick wrote:
gnome-ssh-askpass will lock keyboard focus to its window, preventing
focus stealing and key logging attacks from other X clients. It also
aborts if it fails to gain a lock on the keyboard. Try starting two
copies of gnome-ssh-askpass at the same time, and see what happens:
Interesting... ksshaskpass doesn't do anything like that. Not that I think
focus stealing is really a good solution for this problem anyway.
Kevin Kofler
10:02 p.m.
On Fri, Jan 9, 2009 at 6:56 PM, Kevin Kofler <kevin.kofler(a)chello.at> wrote:
Callum Lerwick wrote:
> gnome-ssh-askpass will lock keyboard focus to its window, preventing
> focus stealing and key logging attacks from other X clients. It also
> aborts if it fails to gain a lock on the keyboard. Try starting two
> copies of gnome-ssh-askpass at the same time, and see what happens:
Interesting... ksshaskpass doesn't do anything like that. Not that I think
focus stealing is really a good solution for this problem anyway.
Kevin Kofler
You're against focus stealing, but for the GUI prompt "feature"?
On Thu, Jan 8, 2009 at 9:11 PM, Kevin Kofler <kevin.kofler(a)chello.at> wrote:
Uh, a GUI prompt for the passphrase is a feature. It also gets used
when you
use SSH from a GUI app, such as a client for a version control system. I
don't see how this is a problem.
Kevin Kofler
/me confused.
done with this now,
jerry
7:27 p.m.
On Fri, Jan 9, 2009 at 9:16 AM, John W. Linville <linville(a)redhat.com> wrote:
I'm not sure I see your point. Changing focus to another window
just
to type a passphrase seems at best to add zero benefit and at worst
to provide surprise and distraction. What is the benefit?
[snip]
Presumably the GUI password dialog can XGrabKeyboard to prevent
keyboard sniffing. Your terminal can probably do it to, but you
probably have to tell it to and you probably do not.
A central unspoofable password dialog does make sense for improving
security, Fedora isn't there yet… but CLI apps kicking you to some
external dialog for passwords is a necessary step to that end.
9:33 p.m.
On 1/9/09, Gregory Maxwell <gmaxwell(a)gmail.com> wrote:
A central unspoofable password dialog does make sense for improving
security, Fedora isn't there yet… but CLI apps kicking you to some
external dialog for passwords is a necessary step to that end.
And that's been proven by whom?
jerry
1:36 p.m.
On Fri, Jan 9, 2009 at 10:33 PM, Jerry Amundson <jamundso(a)gmail.com> wrote:
On 1/9/09, Gregory Maxwell <gmaxwell(a)gmail.com> wrote:
> A central unspoofable password dialog does make sense for improving
> security, Fedora isn't there yet… but CLI apps kicking you to some
> external dialog for passwords is a necessary step to that end.
And that's been proven by whom?
…
Perhaps you didn't understand what I was saying.
It is considered a reasonable goal by many that there ought to be a
way for joe-average-user to be confident that when he is entering a
password it isn't being entered into some spoof/trojan program.
There are a number of ways to accomplish this, for example: There
could be a secure system level password entry box that requires a
magic keypress to activate, and the keypress can't be intercepted by
anything 'user level'. (The windows NT press ctrl-alt-delete login box
is an example of this). Or, for example, the entry could be
accomplished via a secure hardware device (such as a smartcard or
external keypad) which communicates with a protected system level
service. I'm sure you can imagine a few more possibilities.
Individual apps (be they CLI or GUI) prompting the user for their
password inline is simply incompatible with that goal. If every little
application has it's own password prompts and password entry
facilities the user can't be confident that the one he's talking to is
the one he wants and isn't just some trojan.
This isn't to say that the one-password-dialog-to-rule-them-all must
be obnoxious, focus stealing, etc. ... only that a particular security
goal which you may or many not share requires the consistency of
singular password entry point.
4:42 p.m.
Am Samstag, den 10.01.2009, 14:36 -0500 schrieb Gregory Maxwell:
On Fri, Jan 9, 2009 at 10:33 PM, Jerry Amundson
<jamundso(a)gmail.com> wrote:
> On 1/9/09, Gregory Maxwell <gmaxwell(a)gmail.com> wrote:
>> A central unspoofable password dialog does make sense for improving
>> security, Fedora isn't there yet… but CLI apps kicking you to some
>> external dialog for passwords is a necessary step to that end.
>
> And that's been proven by whom?
…
Perhaps you didn't understand what I was saying.
It is considered a reasonable goal by many that there ought to be a
way for joe-average-user to be confident that when he is entering a
password it isn't being entered into some spoof/trojan program.
There are a number of ways to accomplish this, for example: There
could be a secure system level password entry box that requires a
magic keypress to activate, and the keypress can't be intercepted by
anything 'user level'. (The windows NT press ctrl-alt-delete login box
is an example of this). Or, for example, the entry could be
accomplished via a secure hardware device (such as a smartcard or
external keypad) which communicates with a protected system level
service. I'm sure you can imagine a few more possibilities.
Individual apps (be they CLI or GUI) prompting the user for their
password inline is simply incompatible with that goal. If every little
application has it's own password prompts and password entry
facilities the user can't be confident that the one he's talking to is
the one he wants and isn't just some trojan.
This isn't to say that the one-password-dialog-to-rule-them-all must
be obnoxious, focus stealing, etc. ... only that a particular security
goal which you may or many not share requires the consistency of
singular password entry point.
Perhpas slightly off-topic - but related - bug:
https://bugzilla.redhat.com/show_bug.cgi?id=136341
From five years ago.
6:43 p.m.
On Thu, 2009-01-08 at 23:42 +0100, nodata wrote:
Am Donnerstag, den 08.01.2009, 17:21 -0500 schrieb Ricky Zhou:
> On 2009-01-08 11:02:14 PM, nodata wrote:
> > I'm wondering when this changed (F10)? I'm sure it didn't act like
this
> > in F9.
> >
> > In F9, I would only be prompted to enter my passphrase if I sshed to a
> > box that accepted pubkey authentication and a ssh-agent did not already
> > have the key.
> > In F10 it asks earlier: when ssh-add is run.
> When you run ssh-add, you are *asking* for the passphrase to be stored
> with ssh-agent, so of course, it has to ask for your passphrase. This
> is the very purpose of ssh-add. Could you be confusing ssh-add with
> something else?
No, I'm just getting annoyed that a GUI is popping up when I am using a
command line app. Not sure of the point of it, it seems counter
intuitive.
If you don't want this, you can turn it off with
gconftool-2 -s -t bool /apps/gnome-keyting/daemon-components/ssh false
8:35 p.m.
On 1/8/09, Matthias Clasen <mclasen(a)redhat.com> wrote:
On Thu, 2009-01-08 at 23:42 +0100, nodata wrote:
> No, I'm just getting annoyed that a GUI is popping up when I am using a
> command line app. Not sure of the point of it, it seems counter
> intuitive.
If you don't want this, you can turn it off with
gconftool-2 -s -t bool /apps/gnome-keyting/daemon-components/ssh false
Users, naturally, would not "want this" - it's intrusive and
completely unnecessary. In the Windows world, IT staff would be be
bombarded with virus warnings.
Please, make "false" the default.
jerry
9:11 p.m.
Jerry Amundson wrote:
Users, naturally, would not "want this" - it's
intrusive and
completely unnecessary. In the Windows world, IT staff would be be
bombarded with virus warnings.
Please, make "false" the default.
Uh, a GUI prompt for the passphrase is a feature. It also gets used when you
use SSH from a GUI app, such as a client for a version control system. I
don't see how this is a problem.
Kevin Kofler
2:28 a.m.
Kevin Kofler píše v Pá 09. 01. 2009 v 04:11 +0100:
Jerry Amundson wrote:
> Users, naturally, would not "want this" - it's intrusive and
> completely unnecessary. In the Windows world, IT staff would be be
> bombarded with virus warnings.
>
> Please, make "false" the default.
Uh, a GUI prompt for the passphrase is a feature. It also gets used when you
use SSH from a GUI app, such as a client for a version control system. I
don't see how this is a problem.
But it is annoying when it asks for password-phrase even if I use ssh
keys without password. It changed between F9 and F10 and I didn't now
since this mail thread why it started open new window when I use command
line.
I am voting for default false too or to put it to FAQ or Release Notes
to F10.
Pavel
--
Pavel Lisy <pavel.lisy(a)gmail.com>
3:23 a.m.
Kevin Kofler <kevin.kofler(a)chello.at> wrote:
Jerry Amundson wrote:
> Users, naturally, would not "want this" - it's intrusive and
> completely unnecessary. In the Windows world, IT staff would be be
> bombarded with virus warnings.
>
> Please, make "false" the default.
Uh, a GUI prompt for the passphrase is a feature. It also gets used when you
use SSH from a GUI app, such as a client for a version control system. I
don't see how this is a problem.
My ssh passphrase is a private matter between me and the ssh client. I
don't even trust ssh-agent, why would I trust some unexpected GUI that
pops up and demands my passphrase?
I was annoyed when the dialog appeared the first time I used ssh in F10
and made a point of turning it off before making an ssh connection. I'd
prefer it to be off by default.
Ron
3:45 a.m.
Ron Yorston wrote:
Kevin Kofler <kevin.kofler(a)chello.at> wrote:
> Jerry Amundson wrote:
>> Users, naturally, would not "want this" - it's intrusive and
>> completely unnecessary. In the Windows world, IT staff would be be
>> bombarded with virus warnings.
>>
>> Please, make "false" the default.
> Uh, a GUI prompt for the passphrase is a feature. It also gets used when you
> use SSH from a GUI app, such as a client for a version control system. I
> don't see how this is a problem.
My ssh passphrase is a private matter between me and the ssh client. I
don't even trust ssh-agent, why would I trust some unexpected GUI that
pops up and demands my passphrase?
That's right. The key argument against a pop-up dialog box that asks
for the passphrase is that we're training people to type secrets into
pop-up dialog boxes. Bad psychology, bad security.
Andrew.
10 a.m.
On Fri, 2009-01-09 at 09:45 +0000, Andrew Haley wrote:
That's right. The key argument against a pop-up dialog box that
asks
for the passphrase is that we're training people to type secrets into
pop-up dialog boxes. Bad psychology, bad security.
And how do you suggest GUI applications ask for passwords on a GUI
system?
10:29 a.m.
2009/1/9 Callum Lerwick <seg(a)haxxed.com>:
On Fri, 2009-01-09 at 09:45 +0000, Andrew Haley wrote:
> That's right. The key argument against a pop-up dialog box that asks
> for the passphrase is that we're training people to type secrets into
> pop-up dialog boxes. Bad psychology, bad security.
And how do you suggest GUI applications ask for passwords on a GUI
system?
We're talking about a command-line tool, *not* a GUI application. See OP.
12:08 a.m.
Jerry Amundson wrote:
On 1/8/09, Matthias Clasen <mclasen(a)redhat.com> wrote:
> On Thu, 2009-01-08 at 23:42 +0100, nodata wrote:
>> No, I'm just getting annoyed that a GUI is popping up when I am using a
>> command line app. Not sure of the point of it, it seems counter
>> intuitive.
> If you don't want this, you can turn it off with
> gconftool-2 -s -t bool /apps/gnome-keyting/daemon-components/ssh false
Users, naturally, would not "want this" - it's intrusive and
completely unnecessary. In the Windows world, IT staff would be be
bombarded with virus warnings.
Please, make "false" the default.
You don't speak on my behalf, please. I do prefer this as a user.
Rahul
12:28 a.m.
On 1/9/09, Rahul Sundaram <sundaram(a)fedoraproject.org> wrote:
Jerry Amundson wrote:
> On 1/8/09, Matthias Clasen <mclasen(a)redhat.com> wrote:
>> On Thu, 2009-01-08 at 23:42 +0100, nodata wrote:
>>> No, I'm just getting annoyed that a GUI is popping up when I am using a
>>> command line app. Not sure of the point of it, it seems counter
>>> intuitive.
>> If you don't want this, you can turn it off with
>> gconftool-2 -s -t bool /apps/gnome-keyting/daemon-components/ssh false
>
> Users, naturally, would not "want this" - it's intrusive and
> completely unnecessary. In the Windows world, IT staff would be be
> bombarded with virus warnings.
>
> Please, make "false" the default.
You don't speak on my behalf, please. I do prefer this as a user.
I stand corrected. I hope, no matter what, that the process stands
exactly the way it is.
In fact, I hope more and more command line tools add this GUI pop-up
feature. It's awesome.
jerry
8:11 a.m.
On Fri, Jan 09, 2009 at 12:28:43AM -0600, Jerry Amundson wrote:
In fact, I hope more and more command line tools add this GUI pop-up
feature. It's awesome.
I'm curious, why is this awesome? It seems to me that if one has
chosen to type commands into a terminal emulator that changing focus
to a different window for further input violates the 'rule of least
suprise'? Or is this some form of "GUI = good, CLI = bad" religion?
John
--
John W. Linville
linville(a)redhat.com
8:22 a.m.
On 1/9/09, John W. Linville <linville(a)redhat.com> wrote:
On Fri, Jan 09, 2009 at 12:28:43AM -0600, Jerry Amundson wrote:
> In fact, I hope more and more command line tools add this GUI pop-up
> feature. It's awesome.
I'm curious, why is this awesome? It seems to me that if one has
chosen to type commands into a terminal emulator that changing focus
to a different window for further input violates the 'rule of least
surprise'? Or is this some form of "GUI = good, CLI = bad" religion?
I agree with you.
I was being sarcastic to the person who preferred the current behavior.
jerry
3:28 p.m.
On Fri, 9 Jan 2009 08:22:50 -0600, "Jerry Amundson" <jamundso(a)gmail.com>
wrote:
>> In fact, I hope more and more command line tools add this
GUI pop-up
>> feature. It's awesome.
>
> I'm curious, why is this awesome? It seems to me that if one has
> chosen to type commands into a terminal emulator that changing focus
> to a different window for further input violates the 'rule of least
> surprise'? Or is this some form of "GUI = good, CLI = bad" religion?
I agree with you.
I was being sarcastic to the person who preferred the current behavior.
Having a session-wide store for keys is awesome, which is why the
old ssh-agent existed in the first place! Logically if you log
through gdm, GNOME desktop is your session, and it ought to keep
your keys now. The old ssh-agent remains in the play only if you
continue using getty-initiated sessions and startx, in which case
the GNOME should defer to pre-existing session. If it doesn't then
file bugs.
As for the religion, I edit everything with gvim, because I want
something that a) support normal clipboard instead of middle-buttoning,
and b) would not destroy my files like gedit. It's launched from
the command line, of course. I guess it makes me spiritually
promiscuous.
-- Pete
3:33 a.m.
Pete Zaitcev <zaitcev(a)redhat.com> wrote:
Having a session-wide store for keys is awesome, which is why the
old ssh-agent existed in the first place!
Then it's awesomeness I can do without. I want to keep control of my
ssh credentials and *always* be prompted when something wants to use
them.
My opinion: gnome-keyring should not act as an ssh agent by default.
Ron
2:35 p.m.
On Sat January 10 2009, Ron Yorston wrote:
Pete Zaitcev <zaitcev(a)redhat.com> wrote:
>Having a session-wide store for keys is awesome, which is why the
>old ssh-agent existed in the first place!
Then it's awesomeness I can do without. I want to keep control of my
ssh credentials and *always* be prompted when something wants to use
them.
My opinion: gnome-keyring should not act as an ssh agent by default.
At least the old ssh-add accepts the option "-c", which makes the ssh-agent to
require a confirmation before it uses the loaded key to authenticate. But this
seems to be maily interesting (imho) in case a ssh agent is forwarded.
Regards,
Till
3:52 p.m.
I sense a bit of dogma creeping in to the discussion.
Is there a way a GUI solution can be made to suit everyone? How about:
* Fedora includes a GUI ssh-agent by default, but
* the traditional ssh-agent is available and easily configurable
* the GUI popup includes a 'turn this heresy off' check box which when
activated tells the user how to turn it back on again, and WHY it's a
good idea to do so.
You don't have to give your passphrase to any agent, you could cancel
/ escape and just use ssh directly.
7:14 a.m.
Jerry Amundson wrote:
On 1/9/09, John W. Linville <linville(a)redhat.com> wrote:
> On Fri, Jan 09, 2009 at 12:28:43AM -0600, Jerry Amundson wrote:
>> In fact, I hope more and more command line tools add this GUI pop-up
>> feature. It's awesome.
> I'm curious, why is this awesome? It seems to me that if one has
> chosen to type commands into a terminal emulator that changing focus
> to a different window for further input violates the 'rule of least
> surprise'? Or is this some form of "GUI = good, CLI = bad" religion?
I agree with you.
I was being sarcastic to the person who preferred the current behavior.
You seem to be sarcastic way too often in this list. It is not so
difficult to accept that there are others with different criteria to yours.
Rahul
2:14 p.m.
On Saturday 10 January 2009 05:14:06 am Rahul Sundaram wrote:
Jerry Amundson wrote:
> On 1/9/09, John W. Linville <linville(a)redhat.com> wrote:
>> On Fri, Jan 09, 2009 at 12:28:43AM -0600, Jerry Amundson wrote:
>>> In fact, I hope more and more command line tools add this GUI pop-up
>>> feature. It's awesome.
>>
>> I'm curious, why is this awesome? It seems to me that if one has
>> chosen to type commands into a terminal emulator that changing focus
>> to a different window for further input violates the 'rule of least
>> surprise'? Or is this some form of "GUI = good, CLI = bad"
religion?
>
> I agree with you.
> I was being sarcastic to the person who preferred the current behavior.
You seem to be sarcastic way too often in this list. It is not so
difficult to accept that there are others with different criteria to yours.
Rahul
Let's not start a flame war with personal attacks, please...
--
Conrad Meyer <konrad(a)tylerc.org>
8:12 a.m.
On Thu, Jan 08, 2009 at 07:43:15PM -0500, Matthias Clasen wrote:
On Thu, 2009-01-08 at 23:42 +0100, nodata wrote:
> Am Donnerstag, den 08.01.2009, 17:21 -0500 schrieb Ricky Zhou:
> > On 2009-01-08 11:02:14 PM, nodata wrote:
> > > I'm wondering when this changed (F10)? I'm sure it didn't act
like this
> > > in F9.
> > >
> > > In F9, I would only be prompted to enter my passphrase if I sshed to a
> > > box that accepted pubkey authentication and a ssh-agent did not already
> > > have the key.
> > > In F10 it asks earlier: when ssh-add is run.
> > When you run ssh-add, you are *asking* for the passphrase to be stored
> > with ssh-agent, so of course, it has to ask for your passphrase. This
> > is the very purpose of ssh-add. Could you be confusing ssh-add with
> > something else?
>
> No, I'm just getting annoyed that a GUI is popping up when I am using a
> command line app. Not sure of the point of it, it seems counter
> intuitive.
If you don't want this, you can turn it off with
gconftool-2 -s -t bool /apps/gnome-keyting/daemon-components/ssh false
Sorry for the troll, but I just had to admire this. One has to love
the easy discoverability of GNOME configuration methods... :-)
John
--
John W. Linville
linville(a)redhat.com
9:19 a.m.
On Fri, 2009-01-09 at 09:12 -0500, John W. Linville wrote:
Sorry for the troll, but I just had to admire this. One has to love
the easy discoverability of GNOME configuration methods... :-)
Because discovering how to configure wireless from the command line is
oh so easy? (;
--
Jesse Keating
Fedora -- Freedom² is a feature!
identi.ca: http://identi.ca/jkeating
10:39 a.m.
On Fri, 2009-01-09 at 09:12 -0500, John W. Linville wrote:
On Thu, Jan 08, 2009 at 07:43:15PM -0500, Matthias Clasen wrote:
> On Thu, 2009-01-08 at 23:42 +0100, nodata wrote:
> > Am Donnerstag, den 08.01.2009, 17:21 -0500 schrieb Ricky Zhou:
> > > On 2009-01-08 11:02:14 PM, nodata wrote:
> > > > I'm wondering when this changed (F10)? I'm sure it didn't
act like this
> > > > in F9.
> > > >
> > > > In F9, I would only be prompted to enter my passphrase if I sshed to
a
> > > > box that accepted pubkey authentication and a ssh-agent did not
already
> > > > have the key.
> > > > In F10 it asks earlier: when ssh-add is run.
> > > When you run ssh-add, you are *asking* for the passphrase to be stored
> > > with ssh-agent, so of course, it has to ask for your passphrase. This
> > > is the very purpose of ssh-add. Could you be confusing ssh-add with
> > > something else?
> >
> > No, I'm just getting annoyed that a GUI is popping up when I am using a
> > command line app. Not sure of the point of it, it seems counter
> > intuitive.
>
> If you don't want this, you can turn it off with
> gconftool-2 -s -t bool /apps/gnome-keyting/daemon-components/ssh false
Sorry for the troll, but I just had to admire this. One has to love
the easy discoverability of GNOME configuration methods... :-)
If you prefer, setting
SSH_AUTH_SOCK=
in your shell works just as well. How is that for discoverability ?
10:47 a.m.
On Fri, Jan 9, 2009 at 10:39 AM, Matthias Clasen <mclasen(a)redhat.com> wrote:
On Fri, 2009-01-09 at 09:12 -0500, John W. Linville wrote:
> On Thu, Jan 08, 2009 at 07:43:15PM -0500, Matthias Clasen wrote:
> > On Thu, 2009-01-08 at 23:42 +0100, nodata wrote:
> > > Am Donnerstag, den 08.01.2009, 17:21 -0500 schrieb Ricky Zhou:
> > > > On 2009-01-08 11:02:14 PM, nodata wrote:
> > > > > I'm wondering when this changed (F10)? I'm sure it
didn't act like this
> > > > > in F9.
> > > > >
> > > > > In F9, I would only be prompted to enter my passphrase if I sshed
to a
> > > > > box that accepted pubkey authentication and a ssh-agent did not
already
> > > > > have the key.
> > > > > In F10 it asks earlier: when ssh-add is run.
> > > > When you run ssh-add, you are *asking* for the passphrase to be
stored
> > > > with ssh-agent, so of course, it has to ask for your passphrase.
This
> > > > is the very purpose of ssh-add. Could you be confusing ssh-add with
> > > > something else?
> > >
> > > No, I'm just getting annoyed that a GUI is popping up when I am using
a
> > > command line app. Not sure of the point of it, it seems counter
> > > intuitive.
> >
> > If you don't want this, you can turn it off with
> > gconftool-2 -s -t bool /apps/gnome-keyting/daemon-components/ssh false
>
> Sorry for the troll, but I just had to admire this. One has to love
> the easy discoverability of GNOME configuration methods... :-)
If you prefer, setting
SSH_AUTH_SOCK=
in your shell works just as well. How is that for discoverability ?
Now my system (new F10 from KDE Live) is *not* popping up the GUI window.
[jerry@jerry-opti755 ~]$ gconftool-2 -g
/apps/gnome-keyring/daemon-components/ssh
true
[jerry@jerry-opti755 ~]$ env | grep SSH
SSH_AGENT_PID=2320
SSH_AUTH_SOCK=/tmp/ssh-bfNSeF2292/agent.2292
SSH_ASKPASS=/usr/libexec/openssh/gnome-ssh-askpass
Is this a bug? :-)
wishing I hadn't stated my thoughts in the first place,
jerry
10:51 a.m.
On Fri, 2009-01-09 at 10:47 -0600, Jerry Amundson wrote:
On Fri, Jan 9, 2009 at 10:39 AM, Matthias Clasen
<mclasen(a)redhat.com> wrote:
> On Fri, 2009-01-09 at 09:12 -0500, John W. Linville wrote:
>> On Thu, Jan 08, 2009 at 07:43:15PM -0500, Matthias Clasen wrote:
>> > On Thu, 2009-01-08 at 23:42 +0100, nodata wrote:
>> > > Am Donnerstag, den 08.01.2009, 17:21 -0500 schrieb Ricky Zhou:
>> > > > On 2009-01-08 11:02:14 PM, nodata wrote:
>> > > > > I'm wondering when this changed (F10)? I'm sure it
didn't act like this
>> > > > > in F9.
>> > > > >
>> > > > > In F9, I would only be prompted to enter my passphrase if I
sshed to a
>> > > > > box that accepted pubkey authentication and a ssh-agent did
not already
>> > > > > have the key.
>> > > > > In F10 it asks earlier: when ssh-add is run.
>> > > > When you run ssh-add, you are *asking* for the passphrase to be
stored
>> > > > with ssh-agent, so of course, it has to ask for your passphrase.
This
>> > > > is the very purpose of ssh-add. Could you be confusing ssh-add
with
>> > > > something else?
>> > >
>> > > No, I'm just getting annoyed that a GUI is popping up when I am
using a
>> > > command line app. Not sure of the point of it, it seems counter
>> > > intuitive.
>> >
>> > If you don't want this, you can turn it off with
>> > gconftool-2 -s -t bool /apps/gnome-keyting/daemon-components/ssh false
>>
>> Sorry for the troll, but I just had to admire this. One has to love
>> the easy discoverability of GNOME configuration methods... :-)
>
> If you prefer, setting
>
> SSH_AUTH_SOCK=
>
> in your shell works just as well. How is that for discoverability ?
Now my system (new F10 from KDE Live) is *not* popping up the GUI window.
[jerry@jerry-opti755 ~]$ gconftool-2 -g
/apps/gnome-keyring/daemon-components/ssh
true
[jerry@jerry-opti755 ~]$ env | grep SSH
SSH_AGENT_PID=2320
SSH_AUTH_SOCK=/tmp/ssh-bfNSeF2292/agent.2292
SSH_ASKPASS=/usr/libexec/openssh/gnome-ssh-askpass
Is this a bug? :-)
No, this means you are running the regular openssh ssh-agent and
not a
gnome-keyring as replacement for ssh-agent.
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
5610
days inactive
5612
days old
48 comments
24 participants
participants (24)
-
Andrew Haley -
Callum Lerwick -
Camilo Mesias -
Conrad Meyer -
Gregory Maxwell -
Horst H. von Brand -
Jerry Amundson -
Jesse Keating -
John W. Linville -
Jonathan Underwood -
Kevin Kofler -
Matthew Woehlke -
Matthias Clasen -
Nalin Dahyabhai -
nodata -
Patrice Dumas -
Pavel Lisy -
Pete Zaitcev -
Rahul Sundaram -
Ralf Ertzinger -
Ricky Zhou -
Ron Yorston -
Till Maas -
Tomas Mraz