currently, ssh-askpass is used in some situations to actually ask the user for a passphrase. in other situations, it is used to prompt for simple confirmation (e.g. ControlMaster=ask, ssh-add -c). Providing the exact same UI for both scenarios is not only surprising for new users; it is also potentially problematic. For example, grabbing the X11 keyboard is a pretty invasive operation (and it is warranted, to avoid other X processes snooping on the passphrase). A prompt for confirmation doesn't need to grab the keyboard, though. I'm proposing to extend the ssh-askpass interface with an environment variable SSH_ASKPASS_CONFIRMATION_ONLY. If this environment variable is set, the ssh-askpass can choose to display a simpler/non-kbd-grabbing UI. ssh, ssh-add, and ssh-agent would need to know to set or clear that environment variable depending on the type of prompt. Another approach would be to define a command line argument, but existing ssh-agent implementations appear to treat multiple arguments differently (e.g. gnome-ssh-askpass concatenates them all into the string prompt; jim knoble's x11-ssh-askpass accepts old-school X11-style arguments). So an environment variable seems cleaner. This would be an optional UI enhancement -- ssh-askpass implementations that don't know about it or don't care would't need to make any changes.
Created attachment 2003 [details] patch to contrib/gnome-ssh-askpass2.c implementing these changes here's a patch implementing this behavior in contrib/gnome-ssh-askpass2.c (does anyone really use gnome1 any more? should we remove contrib/gnome-ssh-askpass1.c?) This patch looks noisy, but most of it is just doing proper indenting, so it's whitespace-only changes.
Created attachment 2004 [details] set SSH_ASKPASS_CONFIRMATION_ONLY when just asking for permission And here is the fix so that ssh sets the environment variable correctly when invoking ssh-askpass.
It is awfully confusing indeed. I was trying several times before realising what was going on. :o
Any news on that?
OpenSSH 8.2 sets a $SSH_ASKPASS_PROMPT environment variable that implements this feature. SSH_ASKPASS_PROMPT=confirm indicates a yes/no confirmation dialog, SSH_ASKPASS_PROMPT=none indicates an informational dialog and everything else is a regular passphrase request. the contrib/gnome-ssh-askpass implementation has been updated to support these.
close bugs that were resolved in OpenSSH 8.5 release cycle