Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to force ssh to always use the program specified by SSH_ASKPASS. In my case the program is just a bash script returning the passphrase.

The problem is, as the ssh documentation says:

If ssh needs a passphrase, it will read the passphrase from the current terminal if it was run from a terminal.

So if I run ssh from a terminal, SSH_ASKPASS is ignored.

There is a similar question: Tell SSH to use a graphical prompt for key passphrase

which proposes create an alias for ssh, like this

$ alias ssh="setsid ssh"

but doesn't work for me, because I don't call ssh directly, is called from git or rsync.

I also found an open issue in the OpenSSH Bugzilla asking for a fix, but was opened in 2002, so I don't believe is going to be implemented.

I'm thinking on probably weird solutions:

  1. Make a fake ssh agent, which calls the script and returns the passphrase.
  2. Create a process looking for new ssh processes and detach them from the terminal before ssh asks for the password.

Any better sugestion?

share|improve this question
1  
If I read that open issue correctly, you can set DISPLAY to some value and then SSH_ASKPASS will be used. – npostavs Aug 12 '14 at 0:19
    
When working in a graphical environment DISPLAY is already set. The question is about forcing SSH to use a GUI passphrase window. I personally would also like to use a (fullscreen) GUI way to provide passphrase but the most of all I would like to provide it once, i.e. I would like to talk to the SSH agent, not to the SSH client. – Pavel Šimerda Jan 31 '15 at 16:55

A per ssh manual:

If ssh does not have a terminal associated with it but DISPLAY and SSH_ASKPASS are set, it will execute the program specified by SSH_ASKPASS.

Therefore you need to disassociate the terminal (e.g. by adding a pipe) and make sure DISPLAY isn't set (if you want to use terminal for your passphrase instead).

Simple example:

echo foo | SSH_ASKPASS=/my/cmd DISPLAY= ssh ...

The same with ssh-add:

$ echo foo | SSH_ASKPASS=/my/cmd DISPLAY= ssh-add id_rsa
ssh_askpass: exec(/my/cmd): No such file or directory
share|improve this answer
    
I couldn't make it work with echo; however setting DISPLAY to whatever and using setsid did the trick. See my post – Alberto Feb 12 at 9:18

Unfortunately, I cannot access the open issue that you have linked, but I have tried @npostavs' suggestion (set DISPLAY to some value) and it seems to work1.

For example:

# List heads in a remote git repo
DISPLAY=: setsid git ls-remote -h git@github.tik.uni-stuttgart.de:NFL/tests.git

Where

$ cat ${SSH_ASKPASS}
#!/bin/bash
echo ABCSuperPassword

In this example, SSH_AGENT is invoked by git (set GIT_TRACE=2 for verboser output) effectively providing "ABCSuperPassword" as password for the private key.

Notes

1 DISPLAY is often unset if login into remote terminals.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.