Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: OpenSSH: Users

Unwanted autostarted ssh-agent - 5.3p1 behavior change from 5.2p1?

 

 

OpenSSH users RSS feed   Index | Next | Previous | View Threaded


alaric at caerllewys

Dec 13, 2009, 7:13 PM

Post #1 of 2 (918 views)
Permalink
Unwanted autostarted ssh-agent - 5.3p1 behavior change from 5.2p1?

I'm trying to isolate a behavioral change in OpenSSH. This change is
present on only one of my machines so far. It is the only Gentoo
install I have up, running and complete at this time; it is ALSO the
only machine I have - yet - which is running OpenSSH 5.3p1. All the
rest are running 5.2p1.

I have a persistent-auth scheme that I have been using for over ten
years. It involves .bash_profile starting a persistent ssh-agent when I
log into a machine on my network remotely via ssh for the first time,
and saving the agent's environment variables in .ssh/agent.$HOSTNAME so
that it can be sourced by subsequent logins by the same user, allowing
the user to share the same ssh-agent across multiple successive or
concurrent logins as long as it remains present.

On the one machine that has been updated to 5.3p1, however, and ONLY
on that machine, an extra ssh-agent is being started "for me", NOT by
me, which is screwing up my scripting. It writes its variables into
the subtly different .ssh/agent-$HOSTNAME, or if that already exists,
.ssh/agent-$HOSTNAME-ssh. I can't use this ssh-agent in the persistent
manner described above because it self-terminates as soon as the login
that it was started for exits. This makes it about as much use to me as
a bicycle to a fish.

Is this a behavioral change in OpenSSH? If so, is there a way to
disable it? It's not useful to me, and in fact caused me quite a few
headaches until I figured out what was going on. For now, I'm resorting
to killing the unwanted ssh-agent before starting my own, but this is a
bit of a brute-force approach and not really ideal. (But then, starting
an ssh-agent by default for every remote login without even trying to
find out whether the user or the system administrator wants one started
or not doesn't seem to me like a very good idea in the first place.)


If it's NOT OpenSSH's doing, then I need to dig further into the Gentoo
login auth system and try to find whether they're doing it.



--
Phil Stracchino, CDK#2 DoD#299792458 ICBM: 43.5607, -71.355
alaric [at] caerllewys alaric [at] metrocast phil [at] co
Renaissance Man, Unix ronin, Perl hacker, Free Stater
It's not the years, it's the mileage.


code at pizzashack

Dec 14, 2009, 3:58 PM

Post #2 of 2 (861 views)
Permalink
Re: Unwanted autostarted ssh-agent - 5.3p1 behavior change from 5.2p1? [In reply to]

On Sun, Dec 13, 2009 at 10:13:54PM -0500, Brother Railgun of Reason wrote:
> I'm trying to isolate a behavioral change in OpenSSH. This change is
> present on only one of my machines so far. It is the only Gentoo
> install I have up, running and complete at this time; it is ALSO the
> only machine I have - yet - which is running OpenSSH 5.3p1. All the
> rest are running 5.2p1.

It very likely has nothing to do with OpenSSH per se, though I'm not
an authority on what recent releases of SSH code are doing. However,
some distros and/or desktop environments are now doing this for you by
default. The idea here is that the only sensible way to start an
ssh-agent is in the parent process of your X session (which is mostly
true, though if you're a power user, you may want something else). In
so doing, you make the agent available to all shell sessions started
by your X session. In general, this is a Good Thing.

The standard way for users to do this themselves is to create (or edit)
~/.xsession, make it an executable shell script, and do something like
this in it:

ssh-agent gnome-session

Of course, Unix/Linux/etc. being what it is, there are a hundred
variations on this theme, including yours. The desire to do this is
so common nowadays that a lot of desktop environment types think they
should just do it for you automatically, or at least present the
option. The trouble is that the control of the starting up of an X
session is a bit esoteric, and lots of people who use it (including
some distro and desktop environment makers) don't seem to understand
all the details (unsurprisingly; as I said, it's esoteric), and you
end up with a lot of different brain-damaged customizations to the
standard X startup scripts, some of which cause the above method to
not work. For example, the GNOME and/or Ubuntu folks screwed this up
pretty nicely here:

https://bugs.launchpad.net/ubuntu/+source/gdm/+bug/398300

But I'm off on tangent, sorry. KDE has also done their own thing,
where if you have the right magic in a config file, it will set up
ssh-agent for you. And, at least on Ubuntu, there's a bit of shell
code in /etc/X11/Xsession.d/90x11-common_ssh-agent that decides
whether or not to automatically start an ssh-agent for you, again
based on some esoteric config file.

A quick search turns up this:

http://www.gentoo.org/doc/en/keychain-guide.xml?style=printable

It may contain the info you need, especially in the section "Using
keychain with KDE" if you're a KDE user. Otherwise, you will probably
have to fish around in /etc/X11 for something that starts ssh-agent.
If you're in that boat, I'd try something like this:

# cd /etc/X11; grep -r -i 'ssh-agent' *

Happy hunting!

--
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

OpenSSH users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.