3

In my /etc/ssh/ssh_config I set the value of PKC11Provider to the path of my PKCS11 library.

However, as the smartcard is not always present, I want to make sure non-interactive ssh sessions (as those run by cron) do not use the PKCS11 library and instead only seek for keys on my harddrive.

So I'd need to type an ssh command like this:

$ ssh -o PKCS11Provider= server.com

However, this is invalid:

command-line line 0: Missing argument.

How do I specify on the commandline that I want to unset a config variable? I searched the manpages and Google, but found no answers (maybe just bad Google-fu).

I tried putting there the value no, but as putting there any other nonsense, ssh then only complains about not finding the dynamic library. It works, then, but it issues this error and I feel this is not the right way to do it.

Thanks for ideas.

  • It seems that the primary problem can be worked around by specifying a particular key to use with the -i option. However, the question about unsetting parameters on command line remains. – Martin Pecka Oct 29 '15 at 21:25
1

It is not possible to unset configuration value from the way how config-reading is made in ssh internals.

You should think about it the other way round. Where do you set this value? You should do this in ~/.ssh/config.

If you use your smart card only for specific hosts, you should put this option into the Match host block.

You run cron scripts under your user? You can use Match exec block to check if you run interactive session or from cron. Or you can even write some script that would check if the cart is there (again use Match exec). If you run it with different user, give him its config file without this option (in his home directory).

Or you can simply provide different ssh_config to the cron script ssh (using -F switch), where you will not have this option set. There are many possibilities in this way. If you are interested in on particular, I can add more details.

  • Thanks for the elaborate answer. Yes, I run the cron job under the regular user to have access to the locally stored keys and to use other user-specific host settings. Checking for being inside an interactive session seems like a good idea. My main problem is the smartcard asks for PIN code, which IMHO cannot be supplied inside a non-interactive shell. – Martin Pecka Oct 29 '15 at 21:39
1

Your PKCS11 library sounds dodgy to me if it doesn't just report no keys if no token/smartcard is present.

FWIW, on openssh 6.6.1,

ssh -o IdentitiesOnly=yes

will not try to authenticate with keys obtained from the PKCS11 library, but it does seem to try and read them anyway, and

ssh -I /dev/null

complained with dlopen /dev/null failed: /dev/null: file too short but went on to ask me for interactive login (since I had no suitable keypair, but -vv showed me that local key pairs were still offered).

  • Exactly what I need, thanks! Although the question is focused more on unsetting variables, so Jakuje's answer is still more relevant and remains the accepted answer. – Martin Pecka Aug 27 '16 at 21:11
  • No problem, I was looking around for problems to my own pkcs woes when I came across this. – Ulrich Schwarz Aug 28 '16 at 12:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.