openssh bugs - Jul 2017 - [Bug 2739] New: ssh-add no longer works with xargs

https://bugzilla.mindrot.org/show_bug.cgi?id=2739

            Bug ID: 2739
           Summary: ssh-add no longer works with xargs
           Product: Portable OpenSSH
           Version: 7.4p1
          Hardware: amd64
                OS: Mac OS X
            Status: NEW
          Severity: minor
          Priority: P5
         Component: ssh-add
          Assignee: unassigned-bugs at mindrot.org
          Reporter: micahculpepper at gmail.com

I have a small script in my bash profile to ensure my ssh keys have
been added to ssh-add. A recent update broke this.

Here is the command I was using:
find ~/.ssh | egrep 'id_rsa$' | xargs ssh-add -K

Here is the output of everything up until ssh-add:
bash-3.2$ find ~/.ssh | egrep 'id_rsa$' | xargs
/Users/user/.ssh/foo_id_rsa /Users/user/.ssh/id_rsa
/Users/user/.ssh/bar_id_rsa

And that is the expected output.

When I run the whole line, here is what I get today, with error
messages:
bash-3.2$ find ~/.ssh | egrep 'id_rsa$' | xargs ssh-add -K
ssh_askpass: exec(/usr/X11R6/bin/ssh-askpass): No such file or
directory
Identity added: /Users/user/.ssh/id_rsa (/Users/user/.ssh/id_rsa)
ssh_askpass: exec(/usr/X11R6/bin/ssh-askpass): No such file or
directory

The middle key isn't passphrase-protected, and it is added
successfully. The other keys aren't added, and apparently ssh-add can't
find "/usr/X11R6/bin/ssh-askpass". I checked, and sure enough, that
file does not exist.

What's weird is that this works if I don't use xargs. I can do exactly
the same thing in a for loop, and it works:
bash-3.2$ for i in $(find ~/.ssh | egrep 'id_rsa$'); do ssh-add -K $i;
done
Enter passphrase for /Users/user/.ssh/foo_id_rsa:
Identity added: /Users/user/.ssh/foo_id_rsa
(/Users/user/.ssh/foo_id_rsa)
Identity added: /Users/user/.ssh/id_rsa (/Users/user/.ssh/id_rsa)
Enter passphrase for /Users/user/.ssh/bar_id_rsa:
Identity added: /Users/user/.ssh/bar_id_rsa
(/Users/user/.ssh/bar_id_rsa)


The xargs approach was working before. And in fact, I can even do it
all on one line and it works:
ssh-add -K /Users/user/.ssh/foo_id_rsa /Users/user/.ssh/id_rsa
/Users/user/.ssh/bar_id_rsa
Enter passphrase for /Users/user/.ssh/foo_id_rsa:
Identity added: /Users/user/.ssh/foo_id_rsa
(/Users/user/.ssh/foo_id_rsa)
Identity added: /Users/user/.ssh/id_rsa (/Users/user/.ssh/id_rsa)
Enter passphrase for /Users/user/.ssh/bar_id_rsa:
Identity added: /Users/user/.ssh/bar_id_rsa
(/Users/user/.ssh/bar_id_rsa)

I also tried the simple case, in an attempt to rule out find or egrep
as the culprit:
bash-3.2$ echo '/Users/user/.ssh/bar_id_rsa' | xargs ssh-add -K
ssh_askpass: exec(/usr/X11R6/bin/ssh-askpass): No such file or
directory


So:
 - One filename at a time works.
 - Multiple filename arguments works.
 - Filenames coming from xargs does not work.


bash-3.2$ uname -a
Darwin hostname 16.6.0 Darwin Kernel Version 16.6.0: Fri Apr 14
16:21:16 PDT 2017; root:xnu-3789.60.24~6/RELEASE_X86_64 x86_64

bash-3.2$ ssh -V
OpenSSH_7.4p1, LibreSSL 2.5.0

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2739

Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at zip.com.au

--- Comment #1 from Darren Tucker <dtucker at zip.com.au> ---
(In reply to Micah Culpepper from comment #0)
> I have a small script in my bash profile to ensure my ssh keys have
> been added to ssh-add. A recent update broke this.
You updated from what to what?  Were the old and/or new built from
source from openssh.com?
> Here is the command I was using:
> find ~/.ssh | egrep 'id_rsa$' | xargs ssh-add -K
The ssh-add we ship does not have a '-K' option.  Where did you get
this package?
> What's weird is that this works if I don't use xargs.
What's likely happening is xargs does not pass a controlling tty. 
Normally this would result in a X-based ssh-askpass popup asking for a
password, but you don't have ssh-askpass.

$ tty
/dev/ttyp0
$ echo | xargs tty
not a tty
> The xargs approach was working before.
worked with a graphic or text prompt for passphrase?
> And in fact, I can even do it
> all on one line and it works:
works with a graphic or text prompt for passphrase?

[...]
> So:
>  - One filename at a time works.
>  - Multiple filename arguments works.
>  - Filenames coming from xargs does not work.
so use a subshell instead of xargs so you retain the controlling tty:

$ ssh-add `find ~/.ssh | egrep 'id_rsa$'`

(or if you don't like old-school backticks):

$ ssh-add $(find ~/.ssh | egrep 'id_rsa$')

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2739

Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |INVALID
             Status|NEW                         |RESOLVED

--- Comment #2 from Darren Tucker <dtucker at zip.com.au>
---
>From the available information it looks like where ever you got your
binaries from didn't include ssh-askpass and in the absence of
additional information there's nothing else we can do.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2739

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #3 from Damien Miller <djm at mindrot.org> ---
closing resolved bugs as of 8.6p1 release

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.