tramp and ssh-agent / ssh-add

tramp and ssh-agent / ssh-add

[Roland Winkler]

I've discussed the following with Michael Albinus on help-gnu-emacs.

The starting point was that I like to run remote emacs sessions as a
subprocess of ssh-agent. When using tramp for file transfer, I need
then ssh-add. The general question is: what is the best way to
communicate from within emacs with the agent?

Right now, I am using a home-made solution that uses a defadvice for
tramp-open-connection-rsh, a function from tramp 2.0, but not
available anymore in tramp 2.1. A hook would be a cleaner
alternative, but again it appears rather limited. Michael pointed
out that not only there is also the gpg agent, but Gnome and KDE
have keyring managers, too, and it might be useful to have a general
interface that allowed one to communicate from within emacs with
these agents. (Personally, I do not know anything about Gnome and
KDE.) Then tramp could use this interface to call ssh-add when
needed, and other packages could use it in a similar way.

I'd greatly prefer such an approach over caching passwords.
(Currently, tramp uses password.el for this which comes from Gnus.)

What do you think?

Roland

tramp and ssh-agent / ssh-add

[Roland Winkler]

Usually when I have emacs running on a remote machine, I do this as
a subprocess of ssh-agent. Then when I establish ssh connections
via tramp, I want to make sure that I type my password only once via
ssh-add. What is the cleanest way to do that? Is there some support
from tramp for that? Right now, my home-made solution uses a
defadvice for tramp-open-connection-rsh, see the code below.
However, if tramp-open-connection-rsh is the right entry point for
what I want to do, it seems to me that a hook might be helpful. Or
am I missing something else?

Thanks,

Roland


(defun ssh-add-p ()
  "Return t if ssh identities known."
  (with-temp-buffer
    (call-process "/usr/bin/ssh-add" nil t nil "-l")
    (goto-char (point-min))
    (not (search-forward "The agent has no identities." nil t))))

(defun ssh-add (&optional password)
  "Add ssh passphrase."
  (interactive)
  (if (ssh-add-p)
      (if (interactive-p) (message "Passphrase already entered."))
    (with-temp-buffer
      (insert (or password (read-passwd "Passphrase: ")) "\n")
      (let ((process-environment (copy-alist process-environment)))
        (setenv "DISPLAY") ;; unset DISPLAY
        (call-process-region (point-min) (point-max)
                             "/usr/bin/ssh-add" t t nil))
      ;; Massage output
      (goto-char (point-min))
      ;; suppress "Enter passphrase for ...: "
      (search-forward ": " nil t)
      (let ((beg (point)))
        (goto-char (point-max))
        (skip-chars-backward " \t\n")
        (message "%s" (buffer-substring-no-properties beg (point)))))))

(defadvice tramp-open-connection-rsh (before ssh-add activate)
  "First call `ssh-add'."
  (if (string= "ssh" (ad-get-arg 1))
      (ssh-add)))

Re: tramp and ssh-agent / ssh-add

[Michael Albinus]

Roland Winkler <Roland.Winkler@physik.uni-erlangen.de> writes:

Hi,

> Usually when I have emacs running on a remote machine, I do this as
> a subprocess of ssh-agent. Then when I establish ssh connections
> via tramp, I want to make sure that I type my password only once via
> ssh-add. What is the cleanest way to do that? Is there some support
> from tramp for that? Right now, my home-made solution uses a
> defadvice for tramp-open-connection-rsh, see the code below.
> However, if tramp-open-connection-rsh is the right entry point for
> what I want to do, it seems to me that a hook might be helpful. Or
> am I missing something else?

I wouldn't do it this way:

- You advice tramp-open-connection-rsh, a function of Tramp 2.0. It
  doesn't exist anymore in Tramp 2.1, so you solution isn't future safe.

- I believe that calling ssh-add on-the-fly is not the intended way. You
  should call it, before you run emacs "as a subprocess of ssh-agent" on
  the remote machine.

- Tramp supports password caching on its own. Install password.el in
  your own lisp directory. You could download it from <http://cvs.savannah.gnu.org/viewvc/*checkout*/tramp/contrib/password.el?revision=1.1.2.1&root=tramp&pathrev=branch-2-0-stable>.

  Then you add the following line to your .emacs, after loading Tramp:

  (setq password-cache-expiry nil)

> Thanks,
>
> Roland

Best regards, Michael.

Re: tramp and ssh-agent / ssh-add

[Roland Winkler]

Michael Albinus <michael.albinus@gmx.de> writes:
> I wouldn't do it this way:
>
> - You advice tramp-open-connection-rsh, a function of Tramp 2.0. It
>   doesn't exist anymore in Tramp 2.1, so you solution isn't future safe.
>
> - I believe that calling ssh-add on-the-fly is not the intended way. You
>   should call it, before you run emacs "as a subprocess of ssh-agent" on
>   the remote machine.

Of course I can run ssh-add before starting emacs. The reason I
didn't want to do that is that not all of these emacs sessions need
ssh at all. So I do not want to type a passphrase that is not needed.
That's why I said that if tramp had a (documented) hook that is
intended to be used for such kind of thing, I would definitely
prefer to use it.

> - Tramp supports password caching on its own. Install password.el in
>   your own lisp directory. You could download it from <http://cvs.savannah.gnu.org/viewvc/*checkout*/tramp/contrib/password.el?revision=1.1.2.1&root=tramp&pathrev=branch-2-0-stable>.

From a security point of view this goes beyond my knowledge. I know
that I need to trust ssh that it handles the passphrases in a safe
way. (And I believe that ssh-agent /ssh-add does not cache the
passphrase itself, but it uses some other method.) When I have
another layer that is actually caching passwords, I feel
uncomfortable that one day something could go wrong. Or do I
misunderstand the approach used by password.el?

Roland

Re: tramp and ssh-agent / ssh-add

[Michael Albinus]

Roland Winkler <Roland.Winkler@physik.uni-erlangen.de> writes:

> That's why I said that if tramp had a (documented) hook that is
> intended to be used for such kind of thing, I would definitely
> prefer to use it.

Tramp 2.0 does not offer such a hook. Tramp 2.1 has two hooks, but they
might not be suited for your needs.

> Roland

Best regards, Michael.

Re: tramp and ssh-agent / ssh-add

[Roland Winkler]

On Sun Mar 30 2008 Michael Albinus wrote:
> Tramp 2.0 does not offer such a hook. 

Would you be able to add one? I know at least one person who would
greatly appreciate it.  :-)
And if its purpose (one of its possible purposes) was properly
documented, I could well imagine that more people would like to use
it.

(I know that tramp is intended to provide a general scheme for file
transfer. Are there other schemes besides beside ssh that use an
agent like ssh? Gpg comes with an agent. But I guess that this is a
different story.)

Thanks,

Roland

Re: tramp and ssh-agent / ssh-add

[Michael Albinus]

"Roland Winkler" <Roland.Winkler@physik.uni-erlangen.de> writes:

>> Tramp 2.0 does not offer such a hook. 
>
> Would you be able to add one? I know at least one person who would
> greatly appreciate it.  :-)
> And if its purpose (one of its possible purposes) was properly
> documented, I could well imagine that more people would like to use
> it.

Not for Tramp 2.0. It doesn't see new features; just bug fixes will be
provided for it.

> (I know that tramp is intended to provide a general scheme for file
> transfer. Are there other schemes besides beside ssh that use an
> agent like ssh? Gpg comes with an agent. But I guess that this is a
> different story.)

There are also plink/pscp, which use pageant as agent. All of them from
the PuTTY package.

However, what I would like to have is a general identity handling
mechanism in Emacs. This shouldn't be restricted to Tramp only. There
shall be interfaces to ssh-agent, to the Gnome and KDE keyring managers,
to gpg, etc.

So I'm not convinced yet to start a Tramp-only solution. password.el,
which is used by Tramp, is also no own development; it comes from Gnus.

> Thanks,
>
> Roland

Best regards, Michael.

Re: tramp and ssh-agent / ssh-add

[Roland Winkler]

On Sun Mar 30 2008 Michael Albinus wrote:
> > (I know that tramp is intended to provide a general scheme for file
> > transfer. Are there other schemes besides beside ssh that use an
> > agent like ssh? Gpg comes with an agent. But I guess that this is a
> > different story.)
> 
> There are also plink/pscp, which use pageant as agent. All of them from
> the PuTTY package.
> 
> However, what I would like to have is a general identity handling
> mechanism in Emacs. This shouldn't be restricted to Tramp only. There
> shall be interfaces to ssh-agent, to the Gnome and KDE keyring managers,
> to gpg, etc.
> 
> So I'm not convinced yet to start a Tramp-only solution. password.el,
> which is used by Tramp, is also no own development; it comes from Gnus.

That's a very good point. With more programs using a similar
approach, it would be nice if this could be done in a coherent way.
(Personally, I do not know anything about Gnome and KDE.)

Should this discussion be continued on emacs-devel? (I do not know
about xemacs.)

Roland

Re: tramp and ssh-agent / ssh-add

[Michael Albinus]

"Roland Winkler" <Roland.Winkler@physik.uni-erlangen.de> writes:

> Should this discussion be continued on emacs-devel? (I do not know
> about xemacs.)

Run Forrest, Run!

> Roland

Best regards, Michael.

Re: tramp and ssh-agent / ssh-add

[Mike Mattie]

[-- Attachment #1: Type: text/plain, Size: 801 bytes --]

On Sun, 30 Mar 2008 16:25:12 +0200
"Roland Winkler" <Roland.Winkler@physik.uni-erlangen.de> wrote:

> On Sun Mar 30 2008 Michael Albinus wrote:
> > Tramp 2.0 does not offer such a hook. 
> 
> Would you be able to add one? I know at least one person who would
> greatly appreciate it.  :-)
> And if its purpose (one of its possible purposes) was properly
> documented, I could well imagine that more people would like to use
> it.
> 
> (I know that tramp is intended to provide a general scheme for file
> transfer. Are there other schemes besides beside ssh that use an
> agent like ssh? Gpg comes with an agent. But I guess that this is a
> different story.)

recent gpg-agents are compatible with ssh. I use gpg-agent for both
without problems.

> Thanks,
> 
> Roland
> 
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: tramp and ssh-agent / ssh-add

[Tim X]

"Roland Winkler" <Roland.Winkler@physik.uni-erlangen.de> writes:

> On Sun Mar 30 2008 Michael Albinus wrote:
>> Tramp 2.0 does not offer such a hook. 
>
> Would you be able to add one? I know at least one person who would
> greatly appreciate it.  :-)
> And if its purpose (one of its possible purposes) was properly
> documented, I could well imagine that more people would like to use
> it.
>
> (I know that tramp is intended to provide a general scheme for file
> transfer. Are there other schemes besides beside ssh that use an
> agent like ssh? Gpg comes with an agent. But I guess that this is a
> different story.)
>

gpg agent is similar to ssh-agent, but for gpg keys. I'm assuming that
if your security concious, your connectinig to the remote system via ssh
already, so I don't see any difference in typing the passphrase into
ssh-add prior to starting emacs compated to typing it in emacs itself. 

I don't like the idea of password caching etc within emacs for tramp
etc. This is the sort of stuff that is all too easy to get wrong and
prefer to leave it to programs that are specifically designed to deal
with such things rather than to something added onto another program to
provide more convenience. 

If you use gnome, you can take advantage of 'seahorse', which provides a
unified way of handling ssh and gpg keys and other things security
related. With seahorse, you are prompted for the passphrase the first
time you try to do something that requires a key and then it manages
things for you so that on subsequent requests for the key, it is all
handled in the background. 

Tim



-- 
tcross (at) rapttech dot com dot au

Re: tramp and ssh-agent / ssh-add

[Michael Albinus]

Tim X <timx@nospam.dev.null> writes:

> If you use gnome, you can take advantage of 'seahorse', which provides a
> unified way of handling ssh and gpg keys and other things security
> related. With seahorse, you are prompted for the passphrase the first
> time you try to do something that requires a key and then it manages
> things for you so that on subsequent requests for the key, it is all
> handled in the background. 

D'accord. But Roland has the use case to run Emacs on a remote
host. He even doesn't start ssh-agent there, which would do the job.

> Tim

Best regards, Michael.

Re: tramp and ssh-agent / ssh-add

[Roland Winkler]

Michael Albinus <michael.albinus@gmx.de> writes:
> D'accord. But Roland has the use case to run Emacs on a remote
> host. He even doesn't start ssh-agent there, which would do the
> job.

Sorry for the confusion. Typically, I do something like

ssh -t winkler@foo.org ssh-agent emacs

So my remote session is only emacs under an ssh-agent. I would like
to be able to run ssh-add from within the remote emacs iff ssh-add
is needed because I want to establish a connection to yet some other
host(s). (Of course, locally I am using shh-agent and ssh-add, too.
Yet that helps me only for the ssh connections that I do starting
from localhost.)

Roland

Re: tramp and ssh-agent / ssh-add

[Mike Mattie]

[-- Attachment #1: Type: text/plain, Size: 873 bytes --]

On Mon, 31 Mar 2008 23:04:13 +0200
Roland Winkler <Roland.Winkler@physik.uni-erlangen.de> wrote:

> Michael Albinus <michael.albinus@gmx.de> writes:
> > D'accord. But Roland has the use case to run Emacs on a remote
> > host. He even doesn't start ssh-agent there, which would do the
> > job.
> 
> Sorry for the confusion. Typically, I do something like
> 
> ssh -t winkler@foo.org ssh-agent emacs
> 
> So my remote session is only emacs under an ssh-agent. I would like
> to be able to run ssh-add from within the remote emacs iff ssh-add
> is needed because I want to establish a connection to yet some other
> host(s). (Of course, locally I am using shh-agent and ssh-add, too.
> Yet that helps me only for the ssh connections that I do starting
> from localhost.)

If I understand you correctly use agent forwarding. It's a sshd option.

> Roland

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: tramp and ssh-agent / ssh-add

[Roland Winkler]

Mike Mattie <codermattie@gmail.com> writes:
> If I understand you correctly use agent forwarding. It's a sshd option.

Thanks, this might be, indeed, what I want, though I want to
understand better why the ssh man page says that agent forwarding
should be enabled with caution. How does agent forwarding compare
with running a second agent on the remote host?

Roland

Re: tramp and ssh-agent / ssh-add

[Tim X]

Roland Winkler <Roland.Winkler@physik.uni-erlangen.de> writes:

> Michael Albinus <michael.albinus@gmx.de> writes:
>> D'accord. But Roland has the use case to run Emacs on a remote
>> host. He even doesn't start ssh-agent there, which would do the
>> job.
>
> Sorry for the confusion. Typically, I do something like
>
> ssh -t winkler@foo.org ssh-agent emacs
>
> So my remote session is only emacs under an ssh-agent. I would like
> to be able to run ssh-add from within the remote emacs iff ssh-add
> is needed because I want to establish a connection to yet some other
> host(s). (Of course, locally I am using shh-agent and ssh-add, too.
> Yet that helps me only for the ssh connections that I do starting
> from localhost.)
>

Why do you ssh to the remote box and run emacs? There are good reasons
to do this, but with things like tramp, its not necessary in many
cases. 

While I don't need to do it now, I use to run emacs locally and use
tramp to do a multi-hop connection and edit files on a system at work
that was behind a firewall that could be accessed only from my work
desktop, which I could access via ssh. 

This was over a 56k modem and it worked just fine. Now I have DSL, but I
still run things locally and use tramp to access files remotely. I also
use sshfs a bit, which is very useful.

Tim


-- 
tcross (at) rapttech dot com dot au

Re: tramp and ssh-agent / ssh-add

[Roland Winkler]

Tim X <timx@nospam.dev.null> writes:
> Why do you ssh to the remote box and run emacs? There are good reasons
> to do this, but with things like tramp, its not necessary in many
> cases. 

For large files and a slow connection, I find that this is the only
useful approach.

Roland

Re: tramp and ssh-agent / ssh-add

[Peter Dyballa]

Am 05.04.2008 um 06:38 schrieb Tim X:
> Why do you ssh to the remote box and run emacs? There are good reasons
> to do this, but with things like tramp, its not necessary in many
> cases.

You can give remote GNU Emacs a distinct look&feel that it won't  
happen that you mix up this host with another one.
You have a fully usable *shell* buffer on the the remote side.
You don't need to transfer large encoded and compressed files from  
there to here and back.
You have instant access, no buffer shuffling, just a bit of searching  
on the desktop.
It's fast, you can use data saved in registers, you don't need to re- 
type your pass-phrase(s) next working day ...

--
Mit friedvollen Grüßen

   Pete

Bake pizza not war!