ProxyCommand that creates identity file

[John Maguire]

Hi there,

I'm working on a project to write a ProxyCommand that reaches out to an SSH
CA to receive an SSH certificate prior to the connection. The ProxyCommand
also creates a tunnel to the upstream SSH server.

When using ProxyCommand alone, the issue is that the identity files are
loaded as soon as SSH has fork/exec'd the process. It does not wait for a
valid server negotiation.

I found the ProxyUseFdPass flag which seemed promising -- here, the
identity files weren't loaded until after the file descriptors are passed
back to the SSH client. Perhaps I could fetch the identity file, return the
fds, and then tunnel the traffic. Unfortunately, it blocks on waitpid(), so
this doesn't work either -- I need the process to stay open to tunnel data.

I considered trying to fork, disown the child, and run the tunnel inside
the child, but unfortunately I am working with Golang, which doesn't allow
forking (except to execute another application.)

I'm looking for any tips on how I might be able to work around this
problem. I'd also be interested in understanding why the identity files are
loaded prior to negotiating a valid server connection.

Thanks,
John