Skip to content

add the ability to set an 'autoaccept' window to avoid constant re-prompts #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mig5 wants to merge 5 commits into
base: master
Choose a base branch
from
Open

add the ability to set an 'autoaccept' window to avoid constant re-prompts #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5290491
add the ability to set an 'autoaccept' window to avoid constant re-pr…
mig5 May 17, 2017
3ddc77a
Remove needless excessive ncat calls, it can happen at the end
mig5 May 17, 2017
8018aa6
Make it possible to set the QUBES_SSH_AGENT_AUTOACCEPT client-side ra…
mig5 May 17, 2017
f8fddaf
less confusing variable assignment (even though it's the same thing)
mig5 May 17, 2017
1a16fb9
Remove redundant conditional, since it's the same thing. Move timesta…
mig5 May 17, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions qubes.SshAgent
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,44 @@
#!/bin/sh

if [ ! -z $QREXEC_SERVICE_ARGUMENT ]; then
QUBES_SSH_AGENT_AUTOACCEPT=$QREXEC_SERVICE_ARGUMENT

# Current time
NOW=$(date +"%s")

# Make a run dir
sudo mkdir -p /var/run/qubes-ssh-agent
sudo chown user:user /var/run/qubes-ssh-agent

# Touch a stat file
touch /var/run/qubes-ssh-agent/${QREXEC_REMOTE_DOMAIN}.stat

# Last time we connected to the agent?
read LASTTIMESTAMP < /var/run/qubes-ssh-agent/${QREXEC_REMOTE_DOMAIN}.stat
if [ $? -eq 1 ]; then
LASTTIMESTAMP=$(($QUBES_SSH_AGENT_AUTOACCEPT +1 ))
fi

# Compare the two timestamps
TIMEDIFF=$(( $NOW - $LASTTIMESTAMP ))

# If it's been too long, prompt the user
if [ $TIMEDIFF -gt $QUBES_SSH_AGENT_AUTOACCEPT ]; then
zenity --question --text "Do you wish to allow $QREXEC_REMOTE_DOMAIN to access your SSH agent \
(now and for the following $QUBES_SSH_AGENT_AUTOACCEPT seconds)?"

case $? in
0)
echo $NOW > /var/run/qubes-ssh-agent/${QREXEC_REMOTE_DOMAIN}.stat
;;
*)
exit 1
;;
esac
# Otherwise, proceed as normal
else
echo $NOW > /var/run/qubes-ssh-agent/${QREXEC_REMOTE_DOMAIN}.stat
fi
fi

ncat -U $SSH_AUTH_SOCK
11 changes: 9 additions & 2 deletions rc.local_client
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,16 @@
# Uncomment next line to enable ssh agent forwarding to the named VM
SSH_VAULT_VM="ssh-vault"
# If you wish to set your client VM's policy to 'allow', you can still
# be prompted at intervals to approve the connection to SSH agent by
# setting a value below (like QUBES_GPG_AUTOACCEPT in Split GPG)
#QUBES_SSH_AGENT_AUTOACCEPT=600

if [ "$SSH_VAULT_VM" != "" ]; then
export SSH_SOCK=/tmp/.SSH_AGENT_$SSH_VAULT_VM
rm -f "$SSH_SOCK"
sudo -u user ncat -k -l -U "$SSH_SOCK" -c "qrexec-client-vm $SSH_VAULT_VM qubes.SshAgent" &
if [ -z $QUBES_SSH_AGENT_AUTOACCEPT ]; then
sudo -u user ncat -k -l -U "$SSH_SOCK" -c "qrexec-client-vm $SSH_VAULT_VM qubes.SshAgent" &
else
sudo -u user ncat -k -l -U "$SSH_SOCK" -c "qrexec-client-vm $SSH_VAULT_VM qubes.SshAgent+$QUBES_SSH_AGENT_AUTOACCEPT" &
fi
fi