Re: IdentityFingerprint feature request

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

 



Daniel Kahn Gillmor wrote:
> On Tue 2018-01-09 15:58:00 -0500, Gregory Seidman wrote:
>> The IdentityFile config (or -i argument) lets you insist on (or prioritize,
>> at least) a particular key file on disk. The key can be retrieved from
>> ssh-agent without decrypting the file on disk, but it must be found at the
>> specified path. I have a use case in which keys are added to ssh-agent on a
>> forwarded connection, but are not present on disk locally. There is
>> currently no way to refer to a key in ssh-agent that is not also sitting on
>> local disk. I propose either a new config (which I'm calling
>> IdentityFingerprint) or extending the existing IdentityFile to accept the
>> fingerprint (e.g. output from ssh-add -l: SHA256:...) of a key and use that
>> if it's found in ssh-agent.
> 
> try storing the output of "ssh-add -L" in a file (instead of "ssh-add
> -l"), and pass the name of that file in IdentityFile.  it's a two-stage
> process instead of a single stage, but it should work fine.

It would be nice for short-lived SSH certs to be added to the key-agent
with options specifying the valid target(s).

Ciao, Michael.

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux