Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I want to force ssh to always use the program specified by SSH_ASKPASS. In my case the program is just a bash script returning the passphrase.

The problem is, as the ssh documentation says:

If ssh needs a passphrase, it will read the passphrase from the current terminal if it was run from a terminal.

So if I run ssh from a terminal, SSH_ASKPASS is ignored.

There is a similar question: Tell SSH to use a graphical prompt for key passphrase

which proposes create an alias for ssh, like this

$ alias ssh="setsid ssh"

but doesn't work for me, because I don't call ssh directly, is called from git or rsync.

I also found an open issue in the OpenSSH Bugzilla asking for a fix, but was opened in 2002, so I don't believe is going to be implemented.

I'm thinking on probably weird solutions:

  1. Make a fake ssh agent, which calls the script and returns the passphrase.
  2. Create a process looking for new ssh processes and detach them from the terminal before ssh asks for the password.

Any better sugestion?

share|improve this question

marked as duplicate by Jakuje, Jeff Schaller, Anthon, Stephen Kitt, garethTheRed Jun 10 at 7:15

This question was marked as an exact duplicate of an existing question.

1  
If I read that open issue correctly, you can set DISPLAY to some value and then SSH_ASKPASS will be used. – npostavs Aug 12 '14 at 0:19
    
When working in a graphical environment DISPLAY is already set. The question is about forcing SSH to use a GUI passphrase window. I personally would also like to use a (fullscreen) GUI way to provide passphrase but the most of all I would like to provide it once, i.e. I would like to talk to the SSH agent, not to the SSH client. – Pavel Šimerda Jan 31 '15 at 16:55

A per ssh manual:

If ssh does not have a terminal associated with it but DISPLAY and SSH_ASKPASS are set, it will execute the program specified by SSH_ASKPASS.

Therefore you need to disassociate the terminal (e.g. by adding a pipe) and make sure DISPLAY isn't set (if you want to use terminal for your passphrase instead).

Simple example:

echo foo | SSH_ASKPASS=/my/cmd DISPLAY= ssh ...

The same with ssh-add:

$ echo foo | SSH_ASKPASS=/my/cmd DISPLAY= ssh-add id_rsa
ssh_askpass: exec(/my/cmd): No such file or directory
share|improve this answer
    
I couldn't make it work with echo; however setting DISPLAY to whatever and using setsid did the trick. See my post – Alberto Feb 12 at 9:18

Unfortunately, I cannot access the open issue that you have linked, but I have tried @npostavs' suggestion (set DISPLAY to some value) and it seems to work1.

For example:

# List heads in a remote git repo
DISPLAY=: setsid git ls-remote -h git@github.tik.uni-stuttgart.de:NFL/tests.git

Where

$ cat ${SSH_ASKPASS}
#!/bin/bash
echo ABCSuperPassword

In this example, SSH_AGENT is invoked by git (set GIT_TRACE=2 for verboser output) effectively providing "ABCSuperPassword" as password for the private key.

Notes

1 DISPLAY is often unset if login into remote terminals.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.