On 16.10.23 04:59, Damien Miller wrote:> On Mon, 16 Oct 2023, openssh at tr.id.au wrote: >> When using the key without an agent, it prompts with a reminder to touch the key: >> >> $ ssh user at remote >> Confirm user presence for key ED25519-SK MD5:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX[...]>> But as soon as I add the key to an agent, it now hides that reminder > > Generally we prefer to use ssh-askpass for agent notifications.*Which* ssh-askpass, OpenBSD's (with the "LEDs" underneath and "only" the usual range of X11 options), GNOME's (which doesn't react to "--help", "-h", or "-?", and doesn't seem to have a manpage, either), or KDE's (with a selection of possible options, including "--help", "--author", "--license", and Qt-specific ones)? As far as I know, they would all require a (in the OP's use case, *second*) user interaction to close them again, and are pretty much unusable for any *multiline* notifications (say, something similar to "VisualHostKey=yes") ... However, IIUC the real problem with the OP's request is that it is indeed the *agent* asking (or not ...) the user to complete the authentication, whereas in the empty-agent version, it's the *ssh* command - which *is* connected to a terminal - doing so. Hence, the prompt is not exactly "hidden", but doesn't readily *have* a place to show up in. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/pkcs7-signature Size: 3449 bytes Desc: S/MIME Cryptographic Signature URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20231016/234d9633/attachment.p7s>
Christian Weisgerber
2023-Oct-16 14:19 UTC
ssh-agent hides sk "confirm user presence" message
Jochen Bern:> *Which* ssh-askpass, OpenBSD's (with the "LEDs" underneath and "only" the > usual range of X11 options), GNOME's (which doesn't react to "--help", "-h", > or "-?", and doesn't seem to have a manpage, either), or KDE's (with a > selection of possible options, including "--help", "--author", "--license", > and Qt-specific ones)? > > As far as I know, they would all require a (in the OP's use case, *second*) > user interaction to close them again,No, ssh-askpass closes automatically when you touch the authenticator. This should be independent of the ssh-askpass implementation: After reading the signature from the authenticator, ssh-agent sends a SIGTERM to the ssh-askpass process. -- Christian "naddy" Weisgerber naddy at mips.inka.de