1

seahorse-ssh-askpass seems broken on my Ubuntu 14.04 (linaro). It outputs the password I type in back to the terminal (stdout).

I do not know how the configuration turned out broken (from fresh install, possibly in the wrong order), but clearly it is not doing its job of storing the ssh key password in the keyring.

ssh-add works, but needs to be done after each new session.

So I would love some help or pointers so I can fix my broken configuration.

UPDATE 1:

Example guidance on how to store an ssh key password in the keyring: How to save an SSH key passphrase in gnome-keyring?

I have a login keyring set as the default keyring, protected by the same password as the user's login, it is unlocked at login, my ssh key is listed in the "Secure Shell" section.

However I can't seem to be able to create the relevant entry in the login keyring, that should be called something like "Unlock password for: <keyname>" (as is the case in my Ubuntu10.04 box) - which used to only require running seahorse-ssh-askpass keyfilename to create.

$SSH_AUTH_SOCK contains /tmp/ssh-<some alpha-numeric sequence>/agent.[0-9]{4}, this file exists with permissions srw-------.

UPDATE 2:

Ok, so now I have managed to stop ssh-agent from starting, there is no other agent running ($SSH_AUTH_SOCK is not set).

How do I start an agent that connects to the gnome keyring?
Seems like killing ssh-agent was not such a great idea: Seahorse SSH Agent Proxy for versions prior to 2.22 - I have seahorse version 3.10.2 so presumably ssh-agent is required for the keyring to function. So back to square 1: what's broken that my key's passwords do not get stored?

5
  • I edited the answer with more details. – Jakuje Mar 20 '17 at 13:40
  • I edited my question: I seem unable to make seahorse talk with ssh-agent - which I understand is how it should work out of the box. – asoundmove Mar 22 '17 at 9:35
  • seahorse should not talk to ssh-agent. They are two daemons talking the same protocol. Only one of them should be running and they should talk wuth ssh and ssh-add tools. – Jakuje Mar 22 '17 at 9:36
  • Quoting wiki.gnome.org/Apps/Seahorse/SSHAgent "In 2.22 and later a full SSH agent is included in gnome-keyring and the agent proxy in Seahorse has been retired." – asoundmove Mar 22 '17 at 9:37
  • Should I have then said: so I do not understand why when I disable ssh-agent, there is no agent left for me to talk to (SSH_AUTH_SOCK unset). The question becomes then how to I get seahorse to talk to ssh and ssh-add? – asoundmove Mar 22 '17 at 10:38
0

seahorse-ssh-askpass is simple GUI application that prompts for the password and writes it to the stdout. It is intended behavior. There is nothing broken about it.

It is invoked by the gnome-keyring-daemon, by ssh or whatever asks you for a password.

To store the key in gnome-keyring, open Keys and password application and add the key in there.

The $SSH_AUTH_SOCK path /tmp/ssh-<some alpha-numeric sequence>/agent.[0-9]{4} says that the connection is not to the gnome-keyring, but it was overwritten by ssh-agent during the startup in some of the scripts. Gnome-keyring creates auth sockets in /run/user/{UID}/keyring/ssh.

So what you are really trying to find out is who started the ssh-agent in your bashrc, profile or Xsession scripts and why, if you already have gnome-keyring running.

10
  • But there is advice about using seahorse-ssh-askpass to store the ssh key password in the keyring. Ot worked with Ubuntu 10.04. So if this is not the way to store the password, how do I? – asoundmove Mar 20 '17 at 12:59
  • where? Ubuntu 10 is 7 years old and what worked then does not have to work today. – Jakuje Mar 20 '17 at 13:01
  • Note my key is already in the keyring, but it does not get used automatically by ssh as the password for the key isn't stored – asoundmove Mar 20 '17 at 13:01
  • I appreciate things may work differently, but then how do I store ssh key passwords for more than a session? – asoundmove Mar 20 '17 at 13:03
  • But it is no job of seahorse-ssh-askpass. It is either that the connection to the keyring is not correctly established, keyring is not unlocked or the password is not stored in there. Non of that is clear from your question. What prints echo $SSH_AUTH_SOCK? What do you see in the gnome-keyring? Please update the question with all the related information. – Jakuje Mar 20 '17 at 13:04
0

Assuming what you're trying to do is save the passphrase for an SSH key already managed by Seahorse, the current (Ubuntu 20.10) location of ssh-askpass for Seahorse seems to be /usr/libexec/seahorse/ssh-askpass.

If ssh-askpass for Seahorse is not located in this location, you can find it with the following command:

$ locate ssh-askpass | grep seahorse

Which will list all files and directories containing ssh-askpass in the name and seahorse in the path. (You may need to install and set up mlocate on your system before you can run this command.)

With the version of Seahorse installed on Ubuntu 20.10 (Seahorse 3.37.2), running the command:

$ <seahorse_ssh-askpass> <key_path>

Seems to work for getting Seahorse to save an SSH-key passphrase.

If you execute the command successfully, it will pop up a dialogue box listing the name of the SSH key and asking for your password. In my case I got a Vala error saying it couldn't grab the keyboard, and, yes, the password I entered got printed to the terminal, but the command seems to have succeeded in making that particular SSH key unlock automatically when my GNOME Keyring is unlocked (i.e. when my computer is powered on and unlocked).

Another reason this might not be working for you is if you've disabled the GNOME Keyring SSH Agent. It should appear by default in Startup Applications, but if it's missing, you can recreate it by clicking "Add" in Startup Applications and pasting the following command:

/usr/bin/gnome-keyring-daemon --start --components=ssh

As far as why running ssh-askpass from the command line seems to be the way to get the GNOME Keyring to save the passphrase for an SSH key (and why this command doesn't seem to be invoked otherwise), no, I don't know why that is. Prior to directly invoking ssh-askpass, using a passphrase-protected SSH key would give me an in-terminal passphrase prompt rather than a GUI popup, and the passphrase would not get saved in Seahorse. It seems like this behavior may be down to a configuration problem with more recent versions of Ubuntu, since it really doesn't make any sense.

EDIT: it seems like maybe the more important thing was going into the Seahorse GUI, clicking OpenSSH Keys, right-clicking on the key in question, selecting "Configure Key for Secure Shell...", and adding each of the servers and usernames to use the key with. I had done this earlier today (before running ssh-askpass) but completely forgotten. Strangely, this part of the process doesn't seem to prompt for a password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.