How to re-lock ssh private key?

[Todd Zullinger]

Todd Denniston wrote:
> Robert Nichols wrote, On 03/03/2009 02:29 PM:
>> Again, thanks for the effort, but NO-GO!
>>
>> I tried changing the setting for that boolean to false, both with
>> gconftool-2 and with the GUI gconf-editor, and also by running
>> gconftool-2 as root.  No change, nada, zip!

Well, all that would do is prevent the gnome-keyring-daemon from being
your ssh-agent.  You _should_ then have the openssh ssh-agent, which
would be configurable in a more documented way.

>> If SSH_AUTH_SOCK is unset or the socket is not present, ssh-add
>> fails with "Could not open a connection to your authentication
>> agent."

Sure.  No surprises there.

>> Looks like the only options are (a) use gnome-keyring-daemon and
>> accept that the key is unlocked forever, or (b) use nothing and
>> enter the passphrase every time.

I can't imagine those are the only choices.  :)

> I am not sure where to modify it now days, but IIRC ssh-agent is
> started before your window manager is going in the xinitrc.  it used
> to be around line 62 of /etc/X11/xinit/xinitrc-common
>
> My guess is the -t needs applied to THAT instance of ssh-agent.

Actually, modifying the ssh-agent invocation shouldn't even be needed.
The -t option to ssh-add should do this.  It just doesn't work with
the gnome-keyring-daemon's ssh agent, but it should work with the
openssh ssh agent.

Bob, when you set /apps/gnome-keyring/daemon-components/ssh to false
(as your user), does that change what program is providing the
SSH_AUTH_SOCK?

I think the first step is to verify that you're replacing the
gnome-keyring-daemon ssh agent with the openssh ssh agent.  It seems
to me that the features you are looking to use are not implemented in
gnome-keyring-daemon.

-- 
Todd        OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Reason obeys itself; and ignorance does whatever is dictated to it.
    -- Thomas Paine

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 542 bytes
Desc: not available
Url : http://lists.fedoraproject.org/pipermail/users/attachments/20090303/a5ead017/attachment-0001.bin