openssh bugs - Aug 2024 - [Bug 3722] New: check ssh key (and other parameters) before running the proxy command

https://bugzilla.mindrot.org/show_bug.cgi?id=3722

            Bug ID: 3722
           Summary: check ssh key (and other parameters) before running
                    the proxy command
           Product: Portable OpenSSH
           Version: 9.8p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: toralf.foerster at gmx.de

$> ssh -i ~/.ssh/foo -o proxyCommand="sh -c 'ssh-keygen -N password
-f
foo'" nobody at nowhere
Warning: Identity file /home/tfoerste/.ssh/foo not accessible: No such
file or directory.
Connection closed by UNKNOWN port 65535

$> ls -l ~/.ssh/foo*
-rw------- 1 tfoerste tfoerste 444 Aug 25 14:13 /home/tfoerste/.ssh/foo
-rw-r--r-- 1 tfoerste tfoerste  95 Aug 25 14:13
/home/tfoerste/.ssh/foo.pub

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3722

--- Comment #1 from Toralf F?rster <toralf.foerster at gmx.de> ---
forget this line in #comment0

$> rm ~/.ssh/foo{,.pub}

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3722

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org

--- Comment #2 from Damien Miller <djm at mindrot.org> ---
Sorry, but I don't understand what you're trying to do in that command
and what you want the behaviour here to be

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3722

--- Comment #3 from Toralf F?rster <toralf.foerster at gmx.de> ---
IMO ssh should not run the given proxy command, if the specified ssh
key is not valid or does not exist. But it runs the proxy command:

$ rm -f /tmp/foo

$ ssh -i ~/.ssh/non-existing-key -o proxyCommand="sh -c 'touch
/tmp/foo'" nobody at nowhere
Warning: Identity file /home/tfoerste/.ssh/non-existing-key not
accessible: No such file or directory.
Connection closed by UNKNOWN port 65535

$ ls -l /tmp/foo
-rw-r--r-- 1 tfoerste tfoerste 0 Aug 26 19:09 /tmp/foo

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.