Circa 2008-08-20 18:08 dixit Daniel Kahn Gillmor:

: I need ssh-add to fail cleanly if it tries and fails to read a key,
: rather than prompting the user. I can't seem to figure out how to do
: that.

[...]

: However, even with all that, if i feed ssh-add a garbage key as a
: subprocess of anything that as a controlling terminal, it opens
: /dev/tty and prompts for a passphrase for the key directly there.

Have you tried running ssh-add via setsid(1)? According to setsid(2)
(used by setsid(1)):

setsid() creates a new session if the calling process is not a
process group leader. The calling process is the leader of the
new session, the process group leader of the new process group,
and has no controlling tty. [...]

--jim

--
jim knoble | jmknoble@pobox.com | http://www.pobox.com/~jmknoble/
(GnuPG key ID: C6F31FFA >>>>>> http://www.pobox.com/~jmknoble/keys/ )
(GnuPG fingerprint: 99D8:1D89:8C66:08B5:5C34::5527:A543:8C33:C6F3:1FFA )
+----------------------------------------------------------------------+
|[L]iberty, as we all know, cannot flourish in a country that is perma-|
| nently on a war footing, or even a near-war footing. --Aldous Huxley|
+----------------------------------------------------------------------+
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/li...enssh-unix-dev

_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/li...enssh-unix-dev

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQIVAwUBSKyszszS7ZTSFznpAQKiMg/8D08LPGJv9zPfdjyXCGtPAUf24/KVjd2b
7Bg8CLGCTlCrZz5BsSZyI9W3qtXfqbpWg6xZswdxv+XMO32rFb ZvICNoeGdladKf
r8ICG1Lc0lnn66XuESVlRrbTPKGp46XQuv0gXbPPXzz7ZSkA8S v9h88hgO89FuKn
dDetN930Tl7SiBovNd2cAYfw5WRcXw+19jCuzjnHlyCjFaP0qq I0iCp6S3vZdor1
t20uYyzl1HZyCzpQl+50XB1ofOPIhGprlYEW3PUtuQymSTHNpO KzTNFPHS4G/go0
bgXjUatrWDzq28ph+6OxwllzFK9AnmaiP7uvVfaEwhp3Kzigfg OZrbwzloLwdCnL
P/HVFOJl5fdTpmP3va0rpwujqfXrgt7MwMkRb00HqX8BjefS7oNa iDYl7Y8AD9E6
g0B84fCXi+Q3KFqxfPpE3LIjpWZQ06sq9H1Degzl4udbboqaVe dhpZgkJ/w9zpB0
0esxqGixzMS3US6uGYlIKjyhHXVoMg47IozbqxUW6fiY2fId+N kKsxNJOI9zjOS5
mmKl6YpnbqnPCoPUdz8+bHPfJe/05HAVQjTkEs6rqrMKD06+Js63bXfglpJEywbt
TI28D8CM24baxaL2OFZrxmqrVMKpr4kAMcVbsrA/IKgrad633K/4kio1sSM/EhSB
9ZR2TCYul9Y=
=9iv7
-----END PGP SIGNATURE-----

Daniel Kahn Gillmor wrote:
>
> On Wed 2008-08-20 18:27:59 -0400, Jim Knoble wrote:
>
> > Have you tried running ssh-add via setsid(1)?
>
> Thanks, Jim! I didn't know about setsid, and it appears to be what
> i'm looking for.
>
> The only remaining irritation is that ssh-add returns a status code of
> 0 rather than the expected non-zero value from a failed attempted add
> under setsid.

Actually, that isn't really working, either. The ssh-add is still
running and grabbing /dev/tty even though you get your prompt back
(check ps from another shell). It will eat terminal input until the
next newline even though you don't see the prompt. The 0 exit code
is coming from setsid, which had no errors.

Instead, try setting SSH_ASKPASS to /bin/false or DISPLAY to a bogus
value, and redirect/close stdin/stdout/stderr. That will make ssh-add
try to use SSH_ASKPASS which will fail (one way or another).

$ SSH_ASKPASS=/bin/false ssh-add foo /dev/null 2>&1
$ DISPLAY=bar ssh-add foo /dev/null 2>&1

=Dave

--
Hello World. David Bronder - Systems Admin
Segmentation Fault ITS-SPA, Univ. of Iowa
Core dumped, disk trashed, quota filled, soda warm. david-bronder@uiowa.edu
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/li...enssh-unix-dev

_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/li...enssh-unix-dev

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQIVAwUBSKzppczS7ZTSFznpAQImvQ//bnaOeFw8eGphvewgUt5eVU6HxqckmYr2
dJlGd1cgH++Ge1xbqobmbWGYlosUGJRAwEN/seXLn0kCzYVuW+ecNEHUgXs9moQX
sflUA6kZ5bhxSJnxT3h54BcrPiNkBmTg3XW+8CnSUoAegNZywN BWkua0Ywra7W43
M1kyziGPsMswdBNZnLDYYXewXa/4D9VtpQiXhkBtgcrwfvlWsBMS/s9Cthh5VxXQ
ak4OX5C2Xqf6KTQ2we0FHuJjrjP5Z4rcir6AFDeRh/hGzEwOc1gq+uUGV0Kdp4SY
aYQY2tQAZfQRAfuTosT1XLFZlefW42ry1azZ4V0GMqgu2oWmor ReKa1iCHPhDpfB
21QoBTw3oxj1fGOeW5JzAv+M+VHruNmOZ5lcKlPLzkzObS5m42 X+XoNGhid6NDxO
gXfM1WN3YuyLd3VxA8fYIGC/UgpXQoR530zWWjt98bNZ2oIPIhNX9zH9v+m8qYm/
ZBv8KIQeWqP5XntBlZa/FM5NN4DVN7U+znyxOCcbmHBJxnXYx8X97x/B0pVJL2Tq
GnI1KrHix2EJ6uhGTuf8oTetj6Od5adxmArUOWdF6m3dTOQ2fL CRjafEBXlKw+OJ
VjpuOUQejy3taKefl7k049bIoL+XxHR/x2F9OOhshRQl6rwuKwcDYVHTIanYQanO
U+bRl3kJrN0=
=RYsq
-----END PGP SIGNATURE-----