openssh unix dev - Jan 2018 - IdentityFingerprint feature request

The IdentityFile config (or -i argument) lets you insist on (or prioritize,
at least) a particular key file on disk. The key can be retrieved from
ssh-agent without decrypting the file on disk, but it must be found at the
specified path. I have a use case in which keys are added to ssh-agent on a
forwarded connection, but are not present on disk locally. There is
currently no way to refer to a key in ssh-agent that is not also sitting on
local disk. I propose either a new config (which I'm calling
IdentityFingerprint) or extending the existing IdentityFile to accept the
fingerprint (e.g. output from ssh-add -l: SHA256:...) of a key and use that
if it's found in ssh-agent.

Is this a reasonable feature? Am I missing a way in which this is already
supported?

--Greg

On Tue, Jan 09, 2018 at 15:58:00 -0500, Gregory Seidman
wrote:
> The IdentityFile config (or -i argument) lets you insist on (or prioritize,
> at least) a particular key file on disk. The key can be retrieved from
> ssh-agent without decrypting the file on disk, but it must be found at the
> specified path. I have a use case in which keys are added to ssh-agent on a
> forwarded connection, but are not present on disk locally. There is
> currently no way to refer to a key in ssh-agent that is not also sitting on
> local disk. I propose either a new config (which I'm calling
> IdentityFingerprint) or extending the existing IdentityFile to accept the
> fingerprint (e.g. output from ssh-add -l: SHA256:...) of a key and use that
> if it's found in ssh-agent.
> 
> Is this a reasonable feature? Am I missing a way in which this is already
> supported?
> 
Do I understand correctly that what you are trying to do is specify what
key to use on a remote system from an forwarded agent socket? If that is
what you are trying to do, you can do already.

You just have to point IdentityFile to a copy of the public key on the
remote system.

-- 
Iain Morgan

On Tue 2018-01-09 15:58:00 -0500, Gregory Seidman wrote:
> The IdentityFile config (or -i argument) lets you insist on (or prioritize,
> at least) a particular key file on disk. The key can be retrieved from
> ssh-agent without decrypting the file on disk, but it must be found at the
> specified path. I have a use case in which keys are added to ssh-agent on a
> forwarded connection, but are not present on disk locally. There is
> currently no way to refer to a key in ssh-agent that is not also sitting on
> local disk. I propose either a new config (which I'm calling
> IdentityFingerprint) or extending the existing IdentityFile to accept the
> fingerprint (e.g. output from ssh-add -l: SHA256:...) of a key and use that
> if it's found in ssh-agent.
try storing the output of "ssh-add -L" in a file (instead of
"ssh-add
-l"), and pass the name of that file in IdentityFile.  it's a two-stage
process instead of a single stage, but it should work fine.

    --dkg

On Tue, Jan 09, 2018 at 06:33:04PM -0500, Daniel Kahn Gillmor
wrote:
> On Tue 2018-01-09 15:58:00 -0500, Gregory Seidman wrote:
> > The IdentityFile config (or -i argument) lets you insist on (or
prioritize,
> > at least) a particular key file on disk. The key can be retrieved from
> > ssh-agent without decrypting the file on disk, but it must be found at
the
> > specified path. I have a use case in which keys are added to ssh-agent
on a
> > forwarded connection, but are not present on disk locally. There is
> > currently no way to refer to a key in ssh-agent that is not also
sitting on
> > local disk. I propose either a new config (which I'm calling
> > IdentityFingerprint) or extending the existing IdentityFile to accept
the
> > fingerprint (e.g. output from ssh-add -l: SHA256:...) of a key and use
that
> > if it's found in ssh-agent.
> 
> try storing the output of "ssh-add -L" in a file (instead of
"ssh-add
> -l"), and pass the name of that file in IdentityFile.  it's a
two-stage
> process instead of a single stage, but it should work fine.
I had to clean up my .ssh/config file a bit to make this work, but that was
my own fault. That approach works for me, so I'm happy to retract my
request. Thanks for the help!
>     --dkg
--Greg

Daniel Kahn Gillmor wrote:
> On Tue 2018-01-09 15:58:00 -0500, Gregory Seidman wrote:
>> The IdentityFile config (or -i argument) lets you insist on (or
prioritize,
>> at least) a particular key file on disk. The key can be retrieved from
>> ssh-agent without decrypting the file on disk, but it must be found at
the
>> specified path. I have a use case in which keys are added to ssh-agent
on a
>> forwarded connection, but are not present on disk locally. There is
>> currently no way to refer to a key in ssh-agent that is not also
sitting on
>> local disk. I propose either a new config (which I'm calling
>> IdentityFingerprint) or extending the existing IdentityFile to accept
the
>> fingerprint (e.g. output from ssh-add -l: SHA256:...) of a key and use
that
>> if it's found in ssh-agent.
> 
> try storing the output of "ssh-add -L" in a file (instead of
"ssh-add
> -l"), and pass the name of that file in IdentityFile.  it's a
two-stage
> process instead of a single stage, but it should work fine.
It would be nice for short-lived SSH certs to be added to the key-agent
with options specifying the valid target(s).

Ciao, Michael.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3829 bytes
Desc: S/MIME Cryptographic Signature
URL:
<http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20180112/ef7b3d66/attachment.p7s>