openssh unix dev - May 2017 - feature request: use HOME before getpwnam() in misc.c

it's really^3 annoying that no matter the value of $HOME, that
tilde_expand_filename() only looks at getpwnam() and friends instead of at least
trying getenv("HOME").

What is the use case?

HOME=longpath_to_config1
ssh -i ~/.ssh/key1

HOME=longpath_to_config2
ssh -i ~/.ssh/key2

but getpwnam() defeats this by always accessing what's in the passwd file.
So .ssh/known_hosts is likewise read/written outside of $HOME/.ssh/ and the
config files too don't remain in local scope.

Sure 99% of users $HOME = pw->pw_dir, but there are a zillion programs that
honor $HOME, so why doesn't the SSH client? Is the concern that SSHD
obviously should get caught up honoring a problematic path when evaluating
Authorized_Keys? Well then have a flag that forces just the use of getpwnam()
for paths that are sensitive. Though frankly, I think this case can be narrowed
further to just when euid=0 and should blithely use HOME when the daemon was
launched by a user on a high port (eg. sshd -D -d).

Thoughts?

Hi,

On Thu, May 18, 2017 at 09:51:04PM +0000, matthew patton
wrote:
> What is the use case?
> 
> HOME=longpath_to_config1
> ssh -i ~/.ssh/key1
> 
> HOME=longpath_to_config2
> ssh -i ~/.ssh/key2
If you run things like that, the "~" is not expanded by ssh but by
your shell.

Try "echo ~/"...

Barking up the wrong tree...

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at
greenie.muc.de
fax: +49-89-35655025                        gert at
net.informatik.tu-muenchen.de

I'm using bash. The shell does the correct thing.?
Sorry ?didn't give the use case clearly.?

I'm talking about the use of tilde inside client config. ?The example was to
illustrate desired behavior. Ssh itself does not eval tilde with any
consideration for environment. That is the problem.?

? Original Message ?
From: Gert Doering
Sent: Friday, May 19, 2017 02:19
To: matthew patton
Cc: openssh-unix-dev at mindrot.org
Subject: Re: feature request: use HOME before getpwnam() in misc.c

Hi,

On Thu, May 18, 2017 at 09:51:04PM +0000, matthew patton
wrote:
> What is the use case?
> 
> HOME=longpath_to_config1
> ssh -i ~/.ssh/key1
> 
> HOME=longpath_to_config2
> ssh -i ~/.ssh/key2
If you run things like that, the "~" is not expanded by ssh but by
your shell.

Try "echo ~/"...

Barking up the wrong tree...

gert
-- 
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany gert at greenie.muc.de
fax: +49-89-35655025 gert at net.informatik.tu-muenchen.de