openssh bugs - Sep 2022 - [Bug 3477] New: Support environment variable or %u token for User

https://bugzilla.mindrot.org/show_bug.cgi?id=3477

            Bug ID: 3477
           Summary: Support environment variable or %u token for User
           Product: Portable OpenSSH
           Version: v9.0p1
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: ben at bencreasy.com

While I realize most of the ~/.ssh/config files are bespoke, I'm trying
to write a shared one for my team.

Right now I'm just leaving the User field out which means that instead
of people typing ssh <server> they type ssh <user>@<server> -
I'd like
to save them some keystrokes. Per
https://man.openbsd.org/man5/ssh_config.5#TOKENS and Env Variables
section ssh_config doesn't seem to support using a variable of any type
here.

However, I discovered that my Windows work computer using Git Bash for
Windows (https://gitforwindows.org/), ${USERNAME} was expanding to my
username properly for the User field. It says that it's running
OpenSSH_8.5p1.

On my Macbook Pro running OpenSSH_9.0p1 it didn't work - ${USER}
($USERNAME is a Windows thing) ssh <host> just gives me:
${USER}@<censored> Permission denied (publickey).

On my Macbook, I cloned down the repo from
https://github.com/openssh/openssh-portable and ran `git checkout
V_8_5_P1` and then compiled from source. Still didn't expand the
variable.

In looking at old bug/enhancement reports, I did notice
https://bugzilla.mindrot.org/show_bug.cgi?id=3140 which seemed to be
just about paths.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3477

--- Comment #1 from Ben Creasy <ben at bencreasy.com> ---
I figured out how to make this work by using %r in the ProxyCommand and
an environment variable using ${VARIABLE}. The %r is for remote user -
I think it's configured in the bastion server or something?

I don't have the ssh config handy since it's work related but I may
reproduce it on my personal machine at some point.

Ultimately I was able to make an ssh config with no hardcoded
usernames, but I still think it would be useful and intuitive to allow
for a variable in the User configuration itself.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3477

H?kon Hallingstad <hakon.hallingstad at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hakon.hallingstad at gmail.com

--- Comment #2 from H?kon Hallingstad <hakon.hallingstad at gmail.com> ---
I have the same need - to SSH to Azure, the username is the full email
address so I would like to set the value to  %u at domain , in a config
file included by all in our organization.

Is this a change that the maintainers would approve of, and if I add
make the code changes, would anyone care to review this?

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3477

skyler.soss at gmail.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |skyler.soss at gmail.com

--- Comment #3 from skyler.soss at gmail.com ---
*** Bug 3796 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3477

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at dtucker.net

--- Comment #4 from Darren Tucker <dtucker at dtucker.net> ---
This wouldn't be very hard to add, but one question I have is: are
there any extant systems that use '%' or '${}' in their native
usernames?

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3477

--- Comment #5 from Darren Tucker <dtucker at dtucker.net> ---
(In reply to Darren Tucker from comment #4)
> This wouldn't be very hard to add, but one question I have is: are
> there any extant systems that use '%' or '${}' in their
native
> usernames?
To partially answer my own question: at least {} is currently
disallowed:

static int
valid_ruser(const char *s)
{  [...]
        for (i = 0; s[i] != 0; i++) {
                if (strchr("'`\";&<>|(){}", s[i])
!= NULL)
                        return 0;

and without the {}, a $ is just a literal:

$ ssh -o User='$FOO' localhost -G | grep user
user $FOO

and a '%' can escape itself, so it's still possible to send one if
necessary:

$ ssh -o User='%%' localhost -G | grep user
user %

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3477

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org
   Attachment #3864|                            |ok?(djm at mindrot.org)
              Flags|                            |

--- Comment #6 from Darren Tucker <dtucker at dtucker.net> ---
Created attachment 3864
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3864&action=edit
Expand %-tokens and ${VAR} environment variables in User

It was a bit more involved than I thought, since %r expands to User,
and %C expands to a hash containing User so those are self-referential.

I worked around that by simply disallowing %r and %C in User
expansions.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3477

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |3740
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #7 from Darren Tucker <dtucker at dtucker.net> ---
This has been added and will be in the 10.0 release:
https://github.com/openssh/openssh-portable/commit/bd30cf784d6e825ef71592fb723c41d4f2fd407b

"User %u at domain" and "User ${LOGNAME}@domain" should both
now work.

Thanks for the report.


Referenced Bugs:

https://bugzilla.mindrot.org/show_bug.cgi?id=3740
[Bug 3740] Tracking bug for OpenSSH 10.0
-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.