https://bugzilla.novell.com/show_bug.cgi?id=436352 Anna Bernathova changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=436352 User Ulrich.Windl@rz.uni-regensburg.de added comment https://bugzilla.novell.com/show_bug.cgi?id=436352#c2 Ulrich Windl changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED Info Provider|Ulrich.Windl@rz.uni-regensburg.de | --- Comment #2 from Ulrich Windl 2008-10-27 09:13:50 MDT --- Do you also have "~/.ssh/id*" files (id_rsa*, id_dsa*, identity*)? I have them. I'm using the GNOME desktop environment, and I'm logging in to a remote openSUSE 11.0 system that I don't manage). When the "Unlock private key" dialogue appears, I cannot switch to another window (it "grabs" the server). As debugging output I see: [...] debug1: Found key in /home/user/.ssh/known_hosts:9 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,keyboard-interactive debug1: Next authentication method: publickey debug1: Offering public key: /home/user/.ssh/id_rsa debug1: Authentications that can continue: publickey,keyboard-interactive debug1: Offering public key: /home/user/.ssh/id_dsa debug1: Authentications that can continue: publickey,keyboard-interactive debug1: Next authentication method: keyboard-interactive Password: (Before the "Password:" prompt I had to close two popup windows) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=436352 User Ulrich.Windl@rz.uni-regensburg.de added comment https://bugzilla.novell.com/show_bug.cgi?id=436352#c4 --- Comment #4 from Ulrich Windl 2008-10-31 01:12:01 MDT --- OK, if you could tell me which setting is responsible for showing the pop-ups, I'll check those. OK, I found something using strace: ssh uses the file "/tmp/keyring-7gSajE/ssh" before the pop-up opens. Using "lsof /tmp/keyring-7gSajE/ssh", I get: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME gnome-key 3485 user1234 15u unix 0xd6497740 0t0 98828 /tmp/keyring-7gSajE/ssh gnome-key 3485 user1234 17u unix 0xd19c0ac0 0t0 10321 /tmp/keyring-7gSajE/ssh There exists no manual page for "gnome.key". So I found out that it's actually "/usr/bin/gnome-keyring-daemon" from gnome-keyring-2.22.1-22.1. It seems the link to all the magic is the environment variable "SSH_AUTH_SOCK=/tmp/keyring-7gSajE/ssh". So actually, when unsetting the variable before using ssh, those pop-ups go away. So maybe a useful extension to ssh would be to ignore the SSH_AUTH_SOCK via command-line option. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=436352 User sbrabec@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=436352#c6 Stanislav Brabec changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sbrabec@novell.com Status|NEEDINFO |ASSIGNED Info Provider|sbrabec@novell.com | --- Comment #6 from Stanislav Brabec 2008-10-31 05:57:44 MDT --- gnome-keyring-daemon is an application, which provides a central storage of passwords. The storage itself is protected, typically by password (smart card protection is in development). I guess that there was an intention to store ssh passwords and maybe ssh key passwords in gnome-keyring. To use gnome-keyring, you have to: 1) Application must be started directly or indirectly by gnome-keyring-daemon 2) Required keyring must exist 3) Required keyring must be unlocked 4) You must approve application to access selected password 1) should be done by session management 2) Default keyring should exist by default 3) Unlocking keyring may be done manually (by password pop-up) or automatically (if your keyring uses the same password as your login, keyring may be unlocked automatically during session start by using keyring PAM module). 4) You must approve ssh to access the password, either once (one access to the password is permitted) or permanently (you will be asked never more when selected application tries to access the password) As you see from the description above, gnome-keyring may generate pop-ups when unlocking the keyring and when asking to access the password. But I see one minor issue of GNOME keyring <-> ssh implementation: I am using password-less SSH keys. When logging to another machine, no password is needed at all, but SSH tries to access GNOME keyring anyway (and I get an obsolete pop-up asking for keyring unlocking). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=436352 Anna Bernathova changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=436352 User sbrabec@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=436352#c9 --- Comment #9 from Stanislav Brabec 2009-02-09 03:39:08 MST --- I am not sure whether original bug report can be still reproduced. Well, I guess that the current behavior is valid, but it may be extremely confusing, because more types of password queries can happen with ssh: In the pop-up, you are entering a password for your GNOME keyring. It's done at most once per session and it is a central password for storing all your passwords. You will be not asked for stored passwords any more. Next you may be asked for challenge/response (e. g. remote password). For unlocking of a ssh certificate, you also may be asked for the password. And finally, some types of authentification (e. g. login with smart-card) may require additional password and you may be asked for it in an arbitrary way defined in the login helper. There are particular problems with GNOME keyring integration: - It forces a separate keyring without chance to change it. - It asks for keyring unlock even if there is no password needed. Note: I do not want to store my SSH passwords. Clicking Cancel once per session works around these bugs. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.