Description of problem: ssh-add -c makes ssh unusable Version-Release number of selected component (if applicable): fed29 & fed30 How reproducible: start gnome-session via ssh-agent in Xclients.gnome-session.sh #!/bin/sh exec -l $SHELL -c "$SSH_AGENT gnome-session" run ssh -A user@host using keys that have been add via ssh-add -c Steps to Reproduce: 1. start gnome-session via ssh-agent in Xclients.gnome-session.sh #!/bin/sh exec -l $SHELL -c "$SSH_AGENT gnome-session" 2. ssh-add -c /path/to/rsa/key 3. ssh -A user@host Actual results: sign_and_send_pubkey: signing failed: agent refused operation Expected results: SSH_ASKPASS dialog to popup as variables have been set to allow this operation Additional info: ssh-add is functional if the "-c" flag is not used, which assumes ssh-agent is functional from being started in Xclients.gnome-session.sh
just a further note. this worked as expected up until fedora 28
reading logs I have observed: fatal: ssh_askpass: exec(/usr/libexec/openssh/ssh-askpass): No such file or directory I have resolved this by moving my zenity askpass script to the following location: /usr/libexec/openssh/ssh-askpass I will look into this further and see where openssh is not asking for $SSH_ASKPASS variable
The /usr/libexec/openssh/ssh-askpass is provided by openssh-askpass subpackage. If you managed to remove it in your system, that is expected that the confirmation does not work. Anyway, you can always modify the path of SSH_ASKPASS *before* starting the ssh-agent to use different askpass application.
I have never installed openssh-askpass. I have always used a zenity script to confirm key usage. It is simple, per the ssh-add man page, successful confirmation is signaled by a zero. I have always set the $SSH_ASKPASS vatiable via .bashrc SSH_ASKPASS=$HOME/bin/ask-pass.sh export SSH_ASKPASS From Fedora 29 something has changed that no longer allows this. I will investigate where to modify the path of SSH_ASKPASS *before* starting the ssh-agent, in use with my zenity script. As this functions with openssh-askpass, I think we can close this as a bug. Also, as a side note openssh-askpass is not installed by default on fedora. Thanks for your help Jakub.
It could have been installed by default in past, but I am really not sure what could have changed in the composes. Indeed, I have that package installed with my Fedora 30 and gnome. I was certainly not installing it explicitly before. But I do not thing this is the problem. If you used different askpass, I think your desktop environment must have changed something how the ssh agent invocation. Actually, gnome modifies the askpass to its own value in /etc/profile.d/gnome-ssh-askpass.sh and anyway is using the gnome-keyring, that has its own askpass and encapsulates the ssh-agent itself. I think you are using something else so better to grep through the /etc/profile.d/ for ssh-agent, check pstree and check how does your desktop environment invokes ssh-agent and where you need to pass the SSH_ASKPASS environment variable. It could be some issue there.
Hi, As I understand, ssh-agent misses the DISPLAY environment variable to call gnome-ssh-askpass: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1812247.
This message is a reminder that Fedora 29 is nearing its end of life. Fedora will stop maintaining and issuing updates for Fedora 29 on 2019-11-26. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '29'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 29 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Fedora 29 changed to end-of-life (EOL) status on 2019-11-26. Fedora 29 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.