Daniel Kahn Gillmor wrote: > On Tue 2018-01-09 15:58:00 -0500, Gregory Seidman wrote: >> The IdentityFile config (or -i argument) lets you insist on (or prioritize, >> at least) a particular key file on disk. The key can be retrieved from >> ssh-agent without decrypting the file on disk, but it must be found at the >> specified path. I have a use case in which keys are added to ssh-agent on a >> forwarded connection, but are not present on disk locally. There is >> currently no way to refer to a key in ssh-agent that is not also sitting on >> local disk. I propose either a new config (which I'm calling >> IdentityFingerprint) or extending the existing IdentityFile to accept the >> fingerprint (e.g. output from ssh-add -l: SHA256:...) of a key and use that >> if it's found in ssh-agent. > > try storing the output of "ssh-add -L" in a file (instead of "ssh-add > -l"), and pass the name of that file in IdentityFile. it's a two-stage > process instead of a single stage, but it should work fine. It would be nice for short-lived SSH certs to be added to the key-agent with options specifying the valid target(s). Ciao, Michael.
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
