3 ms·
Even then, an ssh subprocess can talk to ssh-agent instead of directly reading keys.
by doomrobo 8y ago
Even then, an ssh subprocess can talk to ssh-agent instead of directly reading keys.
- rwmj 8y agoI have some interest in this since I wrote the initial version of ssh integration in qemu, and I have looked at how sshfs is implemented too. For the ssh integration in qemu we used libssh2 (initially, about to be replaced by libssh which is confusingly a different but better library). sshfs on the other hand runs the plain ssh binary in a subprocess and performs its own sftp protocol on top of the ssh connection (with sftp being done inside the sshfs binary). From a security point of view sshfs is certainly a better approach. However for qemu we were concerned mainly about performance, and some testing that I did at the time indicated that the library approach (libssh2/libssh) would perform better which was why we went that way. I guess the lesson here is that retrofitting security to existing applications is difficult, or perhaps the lesson is that Linux applications should be split into cooperating processes using lightweight messaging, like QNX or L4. Even ignoring ssh, the same problem applies to evince + https currently (reading client certificates), and that is certainly not implemented using a subprocess, nor would it be very easy to change that considering how difficult it is to correctly run a subprocess from a multithreaded library using Linux / POSIX APIs.