Bug 1914 - ssh-add: add an option to cryptographically verify if agent can access the matching private key of a given public key
Summary: ssh-add: add an option to cryptographically verify if agent can access the ma...
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh-add (show other bugs)
Version: 5.8p2
Hardware: All Linux
: P2 enhancement
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-06-10 21:37 AEST by Konrad Bucheli
Modified: 2021-04-23 14:57 AEST (History)
1 user (show)

See Also:


Attachments
Patch (5.17 KB, patch)
2011-06-10 21:37 AEST, Konrad Bucheli
no flags Details | Diff
Test key in agent (3.30 KB, patch)
2011-06-10 23:45 AEST, Damien Miller
no flags Details | Diff
Patch 2 (4.77 KB, patch)
2011-06-14 18:55 AEST, Konrad Bucheli
no flags Details | Diff
updated patch for OpenSSH 6.0p1 (4.69 KB, patch)
2012-06-02 14:36 AEST, Konrad Bucheli
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Konrad Bucheli 2011-06-10 21:37:04 AEST
Created attachment 2055 [details]
Patch

I need to cryptographically verify if a given key is load into the agent.

The patch adds the option "-v pubkey" which allows ssh-add to do the same public key authentication procedure as done by sshd. This means it sends a challenge to the agent which must return a valid signature. It does not just "believe" the agent as checking the output of "ssh-add -L" would do.

Use case:
For remote access, the user log in from home. First a one-time-password is used to authenticate the user via PAM. Then we want to check if the user has his key loaded into the ssh-agent. Currently we do this by a ForcedCommand which opens another ssh session, where the key is used for authentication. We would like to do that test directly in the ForcedCommand script.

The patch is based on 5.8p2 and implements that feature for ssh1 and ssh2, contains regression tests and updates the man page.
Comment 1 Damien Miller 2011-06-10 23:45:38 AEST
Created attachment 2056 [details]
Test key in agent

Markus Friedl had a similar patch (attached).
Comment 2 Konrad Bucheli 2011-06-14 18:55:34 AEST
Created attachment 2058 [details]
Patch 2

I first posted a first version patch to the openssh-unix-dev mailing list (04/07/11 09:12) before realizing that Bugzilla would be the better place for it.
Markus Friedl then answered with the patch Damian Miller attached.
I used that patch as inspiration to simplify mine. I just gave another look and there was still room for improvement, so I have now another patch.

The main difference between them is that mine supports also ssh1.
Then we disagree if the option -v (verify) or -T (test) should be used.

I would be happy with either of those two patches as I do not need ssh1 support. I just added it for the sake of completeness and in the hope that it will ease the patch's acceptance...

Is there any support I can give for getting that feature upstream?
Comment 3 Konrad Bucheli 2012-06-02 14:36:32 AEST
Created attachment 2162 [details]
updated patch for OpenSSH 6.0p1
Comment 4 Konrad Bucheli 2019-04-23 09:58:50 AEST
a similar feature was released in OpenSSH 8.0
Comment 5 Damien Miller 2021-04-23 14:57:35 AEST
closing resolved bugs as of 8.6p1 release