IdentityFingerprint feature request
Gregory Seidman
gsslist+ssh at anthropohedron.net
Wed Jan 10 07:58:00 AEDT 2018
The IdentityFile config (or -i argument) lets you insist on (or prioritize,
at least) a particular key file on disk. The key can be retrieved from
ssh-agent without decrypting the file on disk, but it must be found at the
specified path. I have a use case in which keys are added to ssh-agent on a
forwarded connection, but are not present on disk locally. There is
currently no way to refer to a key in ssh-agent that is not also sitting on
local disk. I propose either a new config (which I'm calling
IdentityFingerprint) or extending the existing IdentityFile to accept the
fingerprint (e.g. output from ssh-add -l: SHA256:...) of a key and use that
if it's found in ssh-agent.
Is this a reasonable feature? Am I missing a way in which this is already
supported?
--Greg
More information about the openssh-unix-dev
mailing list