How to re-lock ssh private key?
Robert Nichols
rnicholsNOSPAM at comcast.net
Wed Mar 4 00:05:34 UTC 2009
Todd Denniston wrote:
> Robert Nichols wrote, On 03/03/2009 02:29 PM:
>> Todd Zullinger wrote:
[SNIP]
>>> To disable ssh services in gnome-keyring-daemon:
>>>
>>> gconftool-2 --set -t bool /apps/gnome-keyring/daemon-components/ssh
>>> false
>>>
>>> Some very thin documentation on gnome-keyring-daemon's ssh handling is
>>> at: http://live.gnome.org/GnomeKeyring/Ssh
>>
>> Again, thanks for the effort, but NO-GO!
>>
>> I tried changing the setting for that boolean to false, both with
>> gconftool-2 and with the GUI gconf-editor, and also by running
>> gconftool-2 as root. No change, nada, zip! Log out, log back in,
>> reboot, ..., no change at all. Unsetting the environment variable
>> for SSH_ASKPASS (edited /etc/profile.d/gnome-ssh-askpass.sh so that
>> the variable never gets set) changes nothing. The only thing that
>> has an effect is unsetting SSH_AUTH_SOCK, and doing that means that
>> the passphrase is required _every_time_.
>>
>> If SSH_AUTH_SOCK is unset or the socket is not present, ssh-add
>> fails with "Could not open a connection to your authentication agent."
>> Looks like the only options are (a) use gnome-keyring-daemon and
>> accept that the key is unlocked forever, or (b) use nothing and
>> enter the passphrase every time.
>>
>
> I am not sure where to modify it now days, but IIRC ssh-agent is started
> before your window manager is going in the xinitrc.
> it used to be around line 62 of /etc/X11/xinit/xinitrc-common
>
> My guess is the -t needs applied to THAT instance of ssh-agent.
Sorry, but in /etc/X11/xinit/Xsession I find that SSH_AGENT is not used
with Gnome:
case "$1" in
failsafe)
exec -l $SHELL -c "xterm -geometry 80x24-0-0"
;;
gnome|gnome-session)
# lack of SSH_AGENT is intentional, see #441123. though
# the whole thing should really happen in xinitrc.d anyway.
exec -l $SHELL -c gnome-session
exec /bin/sh -c "exec -l $SHELL -c \"gnome-session\""
;;
kde|kde1|kde2)
exec $SSH_AGENT /bin/sh -c "exec -l $SHELL -c \"startkde\""
;;
...
--
Bob Nichols "NOSPAM" is really part of my email address.
Do NOT delete it.
More information about the fedora-list
mailing list