[prev in list] [next in list] [prev in thread] [next in thread]
List: gentoo-dev
Subject: Re: [gentoo-dev] SSH password authentication support for cvs.eclass
From: Jeremy Maitin-Shepard <jbms () gentoo ! org>
Date: 2003-12-29 4:36:52
[Download RAW message or body]
Nick Jones <carpaski@twobit.net> writes:
>> Additionally, dealing with the SSH known hosts file is somewhat of a
>> problem. If no additional options are passed to SSH, in many cases it
>> is expected that the user would not have added the keys for the relevant
>> host to /root/.ssh/known_hosts before running the ebuild command; thus,
>> the client would not allow the connection.
> You can write an interface inbetween the eclass and ssh using popen and
> forktty. I did this for work. It's fairly aggitating to do, but does
> work. forktty opens master and slave pty's and you use the master as
> the stderr pipe that communicates with ssh for the password and the
> host messages. The data you have to do close() and dup() operations
> to get them forwarded to the interface's stdout and stdin.
I don't quite see how this would do anything better than what I am
currently doing. The issue is not specifying to SSH to ignore that the
host is not in the known_hosts file -- that can be done using a simple
-oStrictHostKeyChecking=no. The issue is that if special care is not
taken, the key is then added to the user's personal known_hosts file,
which is probably undesirable. As I state in the message, the solution
I employ is to use a temporary known_hosts file. This works fine,
except that if the user has specified an alternative location for the
known_hosts file in his ssh_config file, the eclass will not copy the
alternative file to the temporary location, and so if the user did in
fact have the hosts' key in his known_hosts file in an alternative
location, the key would not be checked, when ideally it would. All in
all though, that seems like a very minor problem.
--
Jeremy Maitin-Shepard
--
gentoo-dev@gentoo.org mailing list
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic