tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream: allow some additional control over the use of ssh-askpass 

via $SSH_ASKPASS_REQUIRE, including force-enable/disable. bz#69 ok markus@

OpenBSD-Commit-ID: 3a1e6cbbf6241ddc4405c4246caa2c249f149eb2
This commit is contained in:
djm@openbsd.org 2020-07-14 23:57:01 +00:00 committed by Darren Tucker
parent 6368022cd4
commit aaa8b609a7
4 changed files with 70 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
readpass.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: readpass.c,v 1.61 2020/01/23 07:10:22 dtucker Exp $ */
/* $OpenBSD: readpass.c,v 1.62 2020/07/14 23:57:01 djm Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@ -123,11 +123,26 @@ char *
read_passphrase(const char *prompt, int flags)
{
char cr = '\r', *askpass = NULL, *ret, buf[1024];
int rppflags, use_askpass = 0, ttyfd;
int rppflags, ttyfd, use_askpass = 0, allow_askpass = 0;
const char *askpass_hint = NULL;
const char *s;
if ((s = getenv("DISPLAY")) != NULL)
allow_askpass = *s != '\0';
if ((s = getenv(SSH_ASKPASS_REQUIRE_ENV)) != NULL) {
if (strcasecmp(s, "force") == 0) {
use_askpass = 1;
allow_askpass = 1;
} else if (strcasecmp(s, "prefer") == 0)
use_askpass = allow_askpass;
else if (strcasecmp(s, "never") == 0)
allow_askpass = 0;
}
rppflags = (flags & RP_ECHO) ? RPP_ECHO_ON : RPP_ECHO_OFF;
if (flags & RP_USE_ASKPASS)
if (use_askpass)
debug("%s: requested to askpass", __func__);
else if (flags & RP_USE_ASKPASS)
use_askpass = 1;
else if (flags & RP_ALLOW_STDIN) {
if (!isatty(STDIN_FILENO)) {
@ -153,10 +168,10 @@ read_passphrase(const char *prompt, int flags)
}
}
if ((flags & RP_USE_ASKPASS) && getenv("DISPLAY") == NULL)
if ((flags & RP_USE_ASKPASS) && !allow_askpass)
return (flags & RP_ALLOW_EOF) ? NULL : xstrdup("");
if (use_askpass && getenv("DISPLAY")) {
if (use_askpass && allow_askpass) {
if (getenv(SSH_ASKPASS_ENV))
askpass = getenv(SSH_ASKPASS_ENV);
else

30
ssh-add.1
View File

@ -1,4 +1,4 @@
.\" $OpenBSD: ssh-add.1,v 1.80 2020/06/26 05:04:07 djm Exp $
.\" $OpenBSD: ssh-add.1,v 1.81 2020/07/14 23:57:01 djm Exp $
.\"
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -35,7 +35,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd $Mdocdate: June 26 2020 $
.Dd $Mdocdate: July 14 2020 $
.Dt SSH-ADD 1
.Os
.Sh NAME
@ -174,7 +174,7 @@ Lock the agent with a password.
.El
.Sh ENVIRONMENT
.Bl -tag -width Ds
.It Ev "DISPLAY" and "SSH_ASKPASS"
.It Ev "DISPLAY", "SSH_ASKPASS" and "SSH_ASKPASS_REQUIRE"
If
.Nm
needs a passphrase, it will read the passphrase from the current
@ -195,10 +195,26 @@ This is particularly useful when calling
from a
.Pa .xsession
or related script.
(Note that on some machines it
may be necessary to redirect the input from
.Pa /dev/null
to make this work.)
.Pp
.Ev SSH_ASKPASS_REQUIRE
allows further control over the use of an askpass program.
If this variable is set to
.Dq never
then
.Nm
will never attempt to use one.
If it is set to
.Dq prefer ,
then
.Nm
will prefer to use the askpass program instead of the TTY when requesting
passwords.
Finally, if the variable is set to
.Dq force ,
then the askpass program will be used for all passphrase input regardless
of whether
.Ev DISPLAY
is set.
.It Ev SSH_AUTH_SOCK
Identifies the path of a
.Ux Ns -domain

23
ssh.1
View File

@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" $OpenBSD: ssh.1,v 1.412 2020/04/17 03:34:42 djm Exp $
.Dd $Mdocdate: April 17 2020 $
.\" $OpenBSD: ssh.1,v 1.413 2020/07/14 23:57:01 djm Exp $
.Dd $Mdocdate: July 14 2020 $
.Dt SSH 1
.Os
.Sh NAME
@ -1409,6 +1409,25 @@ or related script.
may be necessary to redirect the input from
.Pa /dev/null
to make this work.)
.It Ev SSH_ASKPASS_REQUIRE
allows further control over the use of an askpass program.
If this variable is set to
.Dq never
then
.Nm
will never attempt to use one.
If it is set to
.Dq prefer ,
then
.Nm
will prefer to use the askpass program instead of the TTY when requesting
passwords.
Finally, if the variable is set to
.Dq force ,
then the askpass program will be used for all passphrase input regardless
of whether
.Ev DISPLAY
is set.
.It Ev SSH_AUTH_SOCK
Identifies the path of a
.Ux Ns -domain

7
ssh.h
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh.h,v 1.89 2018/12/27 03:25:25 djm Exp $ */
/* $OpenBSD: ssh.h,v 1.90 2020/07/14 23:57:01 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
@ -67,6 +67,11 @@
*/
#define SSH_ASKPASS_ENV "SSH_ASKPASS"
/*
* Environment variable to control whether or not askpass is used.
*/
#define SSH_ASKPASS_REQUIRE_ENV "SSH_ASKPASS_REQUIRE"
/*
* Force host key length and server key length to differ by at least this
* many bits. This is to make double encryption with rsaref work.