Skip to content

add argument: default_ssh_auth_sock and some fixes#35

Open
edward-p wants to merge 7 commits into
jbeverly:masterfrom
edward-p:default_ssh_auth_sock
Open

add argument: default_ssh_auth_sock and some fixes#35
edward-p wants to merge 7 commits into
jbeverly:masterfrom
edward-p:default_ssh_auth_sock

Conversation

@edward-p

@edward-p edward-p commented Feb 6, 2022

Copy link
Copy Markdown

Useful when SSH_AUTH_SOCK can't be set in environment. For example: loging in from a Display Manager (such as SDDM).

@kgabor545

Copy link
Copy Markdown

Thank you it solved my problem. I can use pam_ssh_auth_sock in polkit-1.
I just added a little modification to pam_ssh_agent_auth.c:

#include "misc.h"
...
    if(default_ssh_auth_sock && user) {
       default_ssh_auth_sock = pamsshagentauth_percent_expand(default_ssh_auth_sock,
       "h", getpwnam(user)->pw_dir,
       "u", user, NULL);
    }

I'm not sure this is the way to achieve %h, %u expansion in code, but it does it's job.
I make a symlink from the actual socket to the users home with a static name .ssh_auth_sock maybe it could be also a default name if no environment variable.

@edward-p edward-p force-pushed the default_ssh_auth_sock branch from 35feee2 to a2dfbae Compare November 9, 2022 01:50
@edward-p edward-p force-pushed the default_ssh_auth_sock branch from 35caa32 to 0df053b Compare November 9, 2022 03:47
@edward-p edward-p force-pushed the default_ssh_auth_sock branch from 0df053b to d7865aa Compare November 9, 2022 03:53
@edward-p edward-p changed the title add argument: default_ssh_auth_sock add argument: default_ssh_auth_sock and some fixes Nov 15, 2022
@edward-p edward-p force-pushed the default_ssh_auth_sock branch from 948d9dd to 3c8ab96 Compare November 15, 2022 14:57
@pallaswept

pallaswept commented Dec 21, 2024

Copy link
Copy Markdown

I can use pam_ssh_auth_sock in polkit-1.

I found this very useful, also. pam_ssh_agent_auth won't work with polkit without this patch, because polkit clears the environment.
With this patch, it works with pkexec, and also gksu and kdesu, so it works for all my GUI apps as well as sudo and su in CLI.
The expansion of %U is also very helpful to point pam at the default location of the socket, eg auth sufficient pam_ssh_agent_auth.so file=/root/.ssh/authorized_keys_pam default_ssh_auth_sock=/run/user/%U/ssh-agent.socket

Today, it was brought to my attention that run0 would be in my distro's future, so I checked it out, and it uses polkit, so it looks like this patch is required for pam_ssh_agent_auth to work with systemd-run0. I can confirm that it does work.

Thanks @edward-p

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants