3 ms·
I also use the -c (confirm) flag with ssh-add. I don't forward the agent willy-nilly, but if someone still manages to compromise the agent, I will hopefully kn
by scintill76 11y ago
I also use the -c (confirm) flag with ssh-add. I don't forward the agent willy-nilly, but if someone still manages to compromise the agent, I will hopefully know when I'm getting confirmation popups I didn't initiate.
- JoshTriplett 11y agoI wish gnome-keyring's integrated ssh agent supported that.
- scintill76 11y agoIt's been awhile since I set it up, but I believe I've disabled gnome-keyring's agent[1], use the OpenSSH one instead, use ssh-askpass-keyring[2] as the SSH_ASKPASS environment variable to ssh-add to read key passphrases from the keyring (manually invoked via a shell script helper; but only needs to be done once per login session), and GNOME's gnome-ssh-askpass installed as the system default, for key confirmations. (This is on the Cinnamon desktop, so other GNOME setups could be different.) [1] See https://askubuntu.com/questions/63407/where-are-startup-commands-stored https://askubuntu.com/questions/63407/where-are-startup-comm... for how to override in your user dir, or find it in the GUI somewhere. [2] https://launchpad.net/ssh-askpass-keyring https://launchpad.net/ssh-askpass-keyring is the Ubuntu page
- JoshTriplett 11y agoI know how to override it, but I prefer all the other behavior of gnome-keyring's agent. -c is literally the only feature I want that it doesn't have.
- deleted 11y ago[deleted]