Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #256291 > unrolled thread

ssh-add after graphical login

Back to article view | Back to linux.debian.user

Contents

  ssh-add after graphical login Yassine Chaouche <a.chaouche@algerian-radio.dz> - 2023-03-23 09:50 +0100
    Re: ssh-add after graphical login Greg Wooledge <greg@wooledge.org> - 2023-03-23 12:30 +0100
      Re: ssh-add after graphical login Michel Verdier <mv524@free.fr> - 2023-03-23 13:20 +0100
      Re: ssh-add after graphical login Yassine Chaouche <a.chaouche@algerian-radio.dz> - 2023-03-23 13:50 +0100
    Re: ssh-add after graphical login basti <mailinglist@unix-solution.de> - 2023-03-23 13:00 +0100
      Re: ssh-add after graphical login Yassine Chaouche <a.chaouche@algerian-radio.dz> - 2023-03-23 13:20 +0100
    Re: ssh-add after graphical login Greg Wooledge <greg@wooledge.org> - 2023-03-23 14:00 +0100
      Re: ssh-add after graphical login Jeffrey Walton <noloader@gmail.com> - 2023-03-23 14:10 +0100
    Re: ssh-add after graphical login Jeffrey Walton <noloader@gmail.com> - 2023-03-23 14:00 +0100
    Re: ssh-add after graphical login Vincent Lefevre <vincent@vinc17.net> - 2023-03-23 15:20 +0100
    Re: ssh-add after graphical login Erwan David <erwan@rail.eu.org> - 2023-03-23 18:00 +0100
      Re: ssh-add after graphical login Yassine Chaouche <a.chaouche@algerian-radio.dz> - 2023-03-26 10:40 +0200

#256291 — ssh-add after graphical login

Hello all,

I'd like something to run ssh-add right after I login to my desktop
(KDE).
ssh-add needs to prompt me for my passphrase,
and doesn't need any privileges.

What are my options?

Best,

-- 
yassine -- sysadm
+213-779 06 06 23
http://about.me/ychaouche
Looking for side gigs.

[toc] | [next] | [standalone]

#256294

On Thu, Mar 23, 2023 at 09:42:53AM +0100, Yassine Chaouche wrote:
> I'd like something to run ssh-add right after I login to my desktop
> (KDE).
> ssh-add needs to prompt me for my passphrase,
> and doesn't need any privileges.
> 
> What are my options?

On Debian you can create a ~/.xsessionrc file which is executed by
/bin/sh when starting an X session, either by DM login or startx.

Inside that file, you should be able to run:

    ssh-add </dev/null

When run with stdin redirected in that way, it launches a GUI instead
of prompting on the terminal.

The only part I'm unsure of, for you, is how to ensure that this runs
*after* your ssh agent has already been started.  I don't know how ssh
agent startup is handled with Display Manager logins, since I don't use
a DM, and I just start ssh-agent myself, right before running ssh-add.

So, maybe just putting that command in ~/.xsessionrc is sufficient, or
maybe it's not.  You can try it and see.

[toc] | [prev] | [next] | [standalone]

#256297

Le 23 mars 2023 Greg Wooledge a écrit :

> The only part I'm unsure of, for you, is how to ensure that this runs
> *after* your ssh agent has already been started.  I don't know how ssh
> agent startup is handled with Display Manager logins, since I don't use
> a DM, and I just start ssh-agent myself, right before running ssh-add.

I let ssh-agent call gpg-agent. So I do nothing in .ssh/config and in my
.xsession I put :

unset SSH_AGENT_PID
SSH_ASKPASS=/usr/bin/ssh-askpass
SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
export SSH_ASKPASS SSH_AUTH_SOCK

gpg-agent is launched via systemd. In .gnupg/gpg-agent.conf I put :

pinentry-program /usr/bin/pinentry-gnome3
enable-ssh-support

[toc] | [prev] | [next] | [standalone]

#256299

Le 3/23/23 à 12:24, Greg Wooledge a écrit :
>      ssh-add </dev/null
> 
> When run with stdin redirected in that way, it launches a GUI...

Ah!
this is what I was missing!
the whole problem was how to ssh-add in a graphical way,
now that I have found a way,
I can maybe put it in a script inside the XDG Autostart directory.
This might leave more room for the ssh-agent to start,
and the whole desktop to launch
(KDE is somewhat slow on startup)

Best,

-- 
yassine -- sysadm
+213-779 06 06 23
http://about.me/ychaouche
Looking for side gigs.

[toc] | [prev] | [next] | [standalone]

#256295

The ssh config inside ~/.ssh/ has an option 'AddKeysToAgent'.
Why you don't use this?

For example:

Host *
    ControlMaster auto
    ControlPath /run/user/%i/%r@%h-%p
    IdentityFile ~/.ssh/id_rsa
    ControlPersist 3600
    User root
    AddKeysToAgent yes

See man ssh_config

On 23.03.23 09:42, Yassine Chaouche wrote:
> Hello all,
> 
> I'd like something to run ssh-add right after I login to my desktop
> (KDE).
> ssh-add needs to prompt me for my passphrase,
> and doesn't need any privileges.
> 
> What are my options?
> 
> Best,
> 

[toc] | [prev] | [next] | [standalone]

#256298

Le 3/23/23 à 12:56, basti a écrit :
> The ssh config inside ~/.ssh/ has an option 'AddKeysToAgent'.
> Why you don't use this?
> 
> For example:
> 
> Host *
>     ControlMaster auto
>     ControlPath /run/user/%i/%r@%h-%p
>     IdentityFile ~/.ssh/id_rsa
>     ControlPersist 3600
>     User root
>     AddKeysToAgent yes
> 

This is actually an excellent suggestion,
as it also greatly simplifies how I login to remote hosts!
the command line use to be
ssh user@host -p port

now all I need to do is:
ssh host

Thanks again basti!

Best,

-- 
yassine -- sysadm
+213-779 06 06 23
http://about.me/ychaouche
Looking for side gigs.

[toc] | [prev] | [next] | [standalone]

#256300

On Thu, Mar 23, 2023 at 08:53:48AM -0400, Jeffrey Walton wrote:
> On Thu, Mar 23, 2023 at 4:43 AM Yassine Chaouche
> <a.chaouche@algerian-radio.dz> wrote:
> >
> > I'd like something to run ssh-add right after I login to my desktop
> > (KDE).
> > ssh-add needs to prompt me for my passphrase,
> > and doesn't need any privileges.
> >
> > What are my options?
> 
> You can remove the passphrase from the key. Then your agents can use
> the key unattended (without prompting you).

While this is true, it's a really awful suggestion.  Removing the
passphrase from the key means that if the key is ever stolen, the
thief can use it to impersonate you in any context that accepts this
key.

[toc] | [prev] | [next] | [standalone]

#256302

On Thu, Mar 23, 2023 at 8:57 AM Greg Wooledge <greg@wooledge.org> wrote:
>
> On Thu, Mar 23, 2023 at 08:53:48AM -0400, Jeffrey Walton wrote:
> > On Thu, Mar 23, 2023 at 4:43 AM Yassine Chaouche
> > <a.chaouche@algerian-radio.dz> wrote:
> > >
> > > I'd like something to run ssh-add right after I login to my desktop
> > > (KDE).
> > > ssh-add needs to prompt me for my passphrase,
> > > and doesn't need any privileges.
> > >
> > > What are my options?
> >
> > You can remove the passphrase from the key. Then your agents can use
> > the key unattended (without prompting you).
>
> While this is true, it's a really awful suggestion...

Agreed. OP wanted options.

Jeff

[toc] | [prev] | [next] | [standalone]

#256301

On Thu, Mar 23, 2023 at 4:43 AM Yassine Chaouche
<a.chaouche@algerian-radio.dz> wrote:
>
> I'd like something to run ssh-add right after I login to my desktop
> (KDE).
> ssh-add needs to prompt me for my passphrase,
> and doesn't need any privileges.
>
> What are my options?

You can remove the passphrase from the key. Then your agents can use
the key unattended (without prompting you).

Removing the passphrase from the key is no different than storing the
key in a KeyChain without protection so the key can be used unattended
by an agent.

Jeff

[toc] | [prev] | [next] | [standalone]

#256304

On 2023-03-23 09:42:53 +0100, Yassine Chaouche wrote:
> I'd like something to run ssh-add right after I login to my desktop
> (KDE).
> ssh-add needs to prompt me for my passphrase,
> and doesn't need any privileges.
> 
> What are my options?

FYI, with zsh, I'm using wrappers so that I don't need to run ssh-add
directly: it is run automatically when needed by ssh:

  https://www.vinc17.net/unix/zsh-ssh-utils.tar.xz

This is mainly based on code I wrote in 2003, with some improvements
since.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

[toc] | [prev] | [next] | [standalone]

#256309

Le 23/03/2023 à 09:42, Yassine Chaouche a écrit :
> Hello all,
>
> I'd like something to run ssh-add right after I login to my desktop
> (KDE).
> ssh-add needs to prompt me for my passphrase,
> and doesn't need any privileges.
>
> What are my options?
>
> Best,
>

I  do this way :

I create a shell script ~/bin/start-session.sh in this script I have the 
command ssh-add < -

in System Settings > Startup and Shutdown > autostart I add this script 
as a login script

[toc] | [prev] | [next] | [standalone]

#256378

Le 3/23/23 à 17:53, Erwan David a écrit :
> I create a shell script ~/bin/start-session.sh in this script I have the command ssh-add < -
> 
> in System Settings > Startup and Shutdown > autostart I add this script as a login script

Thanks Erwan,
that's what I ended up doing.
the
  ssh-add < -
line looks dubious to me.
It seems like you're redirecting standard input to standard input,
that is to say it doesn't do much.

Best,

-- 
yassine -- sysadm
+213-779 06 06 23
http://about.me/ychaouche
Looking for side gigs.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web