OpenSSH not respecting $HOME when searching for ssh config files

Question

I'm writing some integration tests, that test SSH connections between servers.

For the time being the tests are run from people's laptops. In order not to muck around in the user's (the user running the tests) ~/.ssh/config I create a temporary directory with a bespoke ./tmp/.ssh/config file just for the tests. Then I export HOME=/path/to/tmp. Unfortunately, I've found that openssh doesn't use $HOME to search for an ssh config or identity files.

This is ok if I'm ssh-ing directly to a host, because I can just explicitly set my config using the -F flag. However, if I'm ssh-ing through a bastion and I have a proxycommand, ssh does not pass that configuration file down to my proxycommand. So, if my bespoke ssh config uses a different default username (for example), that configuration won't be used for the proxycommand.

I "could" modify the proxycommand as well (to take an ssh config file as an argument), however, I'd like to know if it's possible to get openssh to look for the config/identity files in a different location just by use of environment variables (without having to pass the configuration file down to each subsequent downstream command). I can change my ssh-agent using SSH_AUTH_SOCK so I was hoping to be able to change the config file directory as well.

Answer 1

According to the source code, ssh gets the home directory from the password file and then, if it does not succeed, from the HOME environment variable.

What you can do is add an Include to every user's ~/.ssh/config, say ~/tmp/user/.ssh/config.

If the file to be included does not exist, ssh will not complain. But if it exists and is readable, it will include it. That should allow you to do the tests without messing too much with their files.

Notice that it poses a security risk. Anybody knowing those paths will be able to inject local configurations for other users if you don't secure them well.