[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: How to re-lock ssh private key?

Todd Denniston wrote:
Robert Nichols wrote, On 03/03/2009 02:29 PM:
Todd Zullinger wrote:
To disable ssh services in gnome-keyring-daemon:

gconftool-2 --set -t bool /apps/gnome-keyring/daemon-components/ssh false

Some very thin documentation on gnome-keyring-daemon's ssh handling is
at: http://live.gnome.org/GnomeKeyring/Ssh

Again, thanks for the effort, but NO-GO!

I tried changing the setting for that boolean to false, both with
gconftool-2 and with the GUI gconf-editor, and also by running
gconftool-2 as root.  No change, nada, zip!  Log out, log back in,
reboot, ..., no change at all.  Unsetting the environment variable
for SSH_ASKPASS (edited /etc/profile.d/gnome-ssh-askpass.sh so that
the variable never gets set) changes nothing.  The only thing that
has an effect is unsetting SSH_AUTH_SOCK, and doing that means that
the passphrase is required _every_time_.

If SSH_AUTH_SOCK is unset or the socket is not present, ssh-add
fails with "Could not open a connection to your authentication agent."
Looks like the only options are (a) use gnome-keyring-daemon and
accept that the key is unlocked forever, or (b) use nothing and
enter the passphrase every time.

I am not sure where to modify it now days, but IIRC ssh-agent is started before your window manager is going in the xinitrc.
it used to be around line 62 of /etc/X11/xinit/xinitrc-common

My guess is the -t needs applied to THAT instance of ssh-agent.

Sorry, but in /etc/X11/xinit/Xsession I find that SSH_AGENT is not used
with Gnome:

    case "$1" in
            exec -l $SHELL -c "xterm -geometry 80x24-0-0"
            # lack of SSH_AGENT is intentional, see #441123.  though
            # the whole thing should really happen in xinitrc.d anyway.
            exec -l $SHELL -c gnome-session
            exec /bin/sh -c "exec -l $SHELL -c \"gnome-session\""
            exec $SSH_AGENT /bin/sh -c "exec -l $SHELL -c \"startkde\""

Bob Nichols     "NOSPAM" is really part of my email address.
                Do NOT delete it.

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]