mirror of git://anongit.mindrot.org/openssh.git
upstream: allow some additional control over the use of ssh-askpass
via $SSH_ASKPASS_REQUIRE, including force-enable/disable. bz#69 ok markus@ OpenBSD-Commit-ID: 3a1e6cbbf6241ddc4405c4246caa2c249f149eb2
This commit is contained in:
djm@openbsd.org
Darren Tucker
parent
6368022cd4
commit
aaa8b609a7
25
readpass.c
25
readpass.c
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: readpass.c,v 1.61 2020/01/23 07:10:22 dtucker Exp $ */
|
||||
/* $OpenBSD: readpass.c,v 1.62 2020/07/14 23:57:01 djm Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2001 Markus Friedl. All rights reserved.
|
||||
*
|
||||
|
|
@ -123,11 +123,26 @@ char *
|
|||
read_passphrase(const char *prompt, int flags)
|
||||
{
|
||||
char cr = '\r', *askpass = NULL, *ret, buf[1024];
|
||||
int rppflags, use_askpass = 0, ttyfd;
|
||||
int rppflags, ttyfd, use_askpass = 0, allow_askpass = 0;
|
||||
const char *askpass_hint = NULL;
|
||||
const char *s;
|
||||
|
||||
if ((s = getenv("DISPLAY")) != NULL)
|
||||
allow_askpass = *s != '\0';
|
||||
if ((s = getenv(SSH_ASKPASS_REQUIRE_ENV)) != NULL) {
|
||||
if (strcasecmp(s, "force") == 0) {
|
||||
use_askpass = 1;
|
||||
allow_askpass = 1;
|
||||
} else if (strcasecmp(s, "prefer") == 0)
|
||||
use_askpass = allow_askpass;
|
||||
else if (strcasecmp(s, "never") == 0)
|
||||
allow_askpass = 0;
|
||||
}
|
||||
|
||||
rppflags = (flags & RP_ECHO) ? RPP_ECHO_ON : RPP_ECHO_OFF;
|
||||
if (flags & RP_USE_ASKPASS)
|
||||
if (use_askpass)
|
||||
debug("%s: requested to askpass", __func__);
|
||||
else if (flags & RP_USE_ASKPASS)
|
||||
use_askpass = 1;
|
||||
else if (flags & RP_ALLOW_STDIN) {
|
||||
if (!isatty(STDIN_FILENO)) {
|
||||
|
|
@ -153,10 +168,10 @@ read_passphrase(const char *prompt, int flags)
|
|||
}
|
||||
}
|
||||
|
||||
if ((flags & RP_USE_ASKPASS) && getenv("DISPLAY") == NULL)
|
||||
if ((flags & RP_USE_ASKPASS) && !allow_askpass)
|
||||
return (flags & RP_ALLOW_EOF) ? NULL : xstrdup("");
|
||||
|
||||
if (use_askpass && getenv("DISPLAY")) {
|
||||
if (use_askpass && allow_askpass) {
|
||||
if (getenv(SSH_ASKPASS_ENV))
|
||||
askpass = getenv(SSH_ASKPASS_ENV);
|
||||
else
|
||||
|
|
|
|||
30
ssh-add.1
30
ssh-add.1
|
|
@ -1,4 +1,4 @@
|
|||
.\" $OpenBSD: ssh-add.1,v 1.80 2020/06/26 05:04:07 djm Exp $
|
||||
.\" $OpenBSD: ssh-add.1,v 1.81 2020/07/14 23:57:01 djm Exp $
|
||||
.\"
|
||||
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
|
|
@ -35,7 +35,7 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.Dd $Mdocdate: June 26 2020 $
|
||||
.Dd $Mdocdate: July 14 2020 $
|
||||
.Dt SSH-ADD 1
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -174,7 +174,7 @@ Lock the agent with a password.
|
|||
.El
|
||||
.Sh ENVIRONMENT
|
||||
.Bl -tag -width Ds
|
||||
.It Ev "DISPLAY" and "SSH_ASKPASS"
|
||||
.It Ev "DISPLAY", "SSH_ASKPASS" and "SSH_ASKPASS_REQUIRE"
|
||||
If
|
||||
.Nm
|
||||
needs a passphrase, it will read the passphrase from the current
|
||||
|
|
@ -195,10 +195,26 @@ This is particularly useful when calling
|
|||
from a
|
||||
.Pa .xsession
|
||||
or related script.
|
||||
(Note that on some machines it
|
||||
may be necessary to redirect the input from
|
||||
.Pa /dev/null
|
||||
to make this work.)
|
||||
.Pp
|
||||
.Ev SSH_ASKPASS_REQUIRE
|
||||
allows further control over the use of an askpass program.
|
||||
If this variable is set to
|
||||
.Dq never
|
||||
then
|
||||
.Nm
|
||||
will never attempt to use one.
|
||||
If it is set to
|
||||
.Dq prefer ,
|
||||
then
|
||||
.Nm
|
||||
will prefer to use the askpass program instead of the TTY when requesting
|
||||
passwords.
|
||||
Finally, if the variable is set to
|
||||
.Dq force ,
|
||||
then the askpass program will be used for all passphrase input regardless
|
||||
of whether
|
||||
.Ev DISPLAY
|
||||
is set.
|
||||
.It Ev SSH_AUTH_SOCK
|
||||
Identifies the path of a
|
||||
.Ux Ns -domain
|
||||
|
|
|
|||
23
ssh.1
23
ssh.1
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: ssh.1,v 1.412 2020/04/17 03:34:42 djm Exp $
|
||||
.Dd $Mdocdate: April 17 2020 $
|
||||
.\" $OpenBSD: ssh.1,v 1.413 2020/07/14 23:57:01 djm Exp $
|
||||
.Dd $Mdocdate: July 14 2020 $
|
||||
.Dt SSH 1
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -1409,6 +1409,25 @@ or related script.
|
|||
may be necessary to redirect the input from
|
||||
.Pa /dev/null
|
||||
to make this work.)
|
||||
.It Ev SSH_ASKPASS_REQUIRE
|
||||
allows further control over the use of an askpass program.
|
||||
If this variable is set to
|
||||
.Dq never
|
||||
then
|
||||
.Nm
|
||||
will never attempt to use one.
|
||||
If it is set to
|
||||
.Dq prefer ,
|
||||
then
|
||||
.Nm
|
||||
will prefer to use the askpass program instead of the TTY when requesting
|
||||
passwords.
|
||||
Finally, if the variable is set to
|
||||
.Dq force ,
|
||||
then the askpass program will be used for all passphrase input regardless
|
||||
of whether
|
||||
.Ev DISPLAY
|
||||
is set.
|
||||
.It Ev SSH_AUTH_SOCK
|
||||
Identifies the path of a
|
||||
.Ux Ns -domain
|
||||
|
|
|
|||
7
ssh.h
7
ssh.h
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: ssh.h,v 1.89 2018/12/27 03:25:25 djm Exp $ */
|
||||
/* $OpenBSD: ssh.h,v 1.90 2020/07/14 23:57:01 djm Exp $ */
|
||||
|
||||
/*
|
||||
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
|
|
@ -67,6 +67,11 @@
|
|||
*/
|
||||
#define SSH_ASKPASS_ENV "SSH_ASKPASS"
|
||||
|
||||
/*
|
||||
* Environment variable to control whether or not askpass is used.
|
||||
*/
|
||||
#define SSH_ASKPASS_REQUIRE_ENV "SSH_ASKPASS_REQUIRE"
|
||||
|
||||
/*
|
||||
* Force host key length and server key length to differ by at least this
|
||||
* many bits. This is to make double encryption with rsaref work.
|
||||
|
|
|
|||
Loading…
Reference in New Issue