Giters

apache / mina-sshd

Apache MINA sshd is a comprehensive Java library for client- and server-side SSH.

Home Page:https://mina.apache.org/sshd-project/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Consider IdentityFile from SSH Config with UserAuthPublicKey

kwin opened this issue · comments

commented

Description

In order to support edge cases with SSH agents like outlined in either

  1. https://keepassxc.org/docs/#faq-ssh-agent-openssh or
  2. https://developer.1password.com/docs/ssh/agent/advanced#match-key-with-host

it is important to evaluate the SSH config entry for IdentityFile settings first. In case it specifies a public key this should be used preferably for the SSH Agent Userauth Request (

mina-sshd/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKey.java

Line 252 in 2c62c72

buffer.putPublicKey(pubKey);
). It should be used as first or as only option (in case IdentiesOnly is set to true) when trying to sign the request.

Motivation

Password managers nowadays often manage private keys. As SSH servers have limitations in terms of number of SSH keys to try or sometimes even only consider the first key (like https://learn.microsoft.com/en-us/azure/devops/repos/git/use-ssh-keys-to-authenticate?view=azure-devops#q-i-have-multiple-ssh-keys-how-do-i-use-the-correct-ssh-key-for-azure-devops) the public key given via IdentityFile should be used even together with SSH agents.

Alternatives considered

No response

Additional context

No response