Sending envvars via ssh agent protocol

[Richard Hansen]

On 2021-09-13T08:48:39+02:00, Werner Koch wrote:
> On Sat, 11 Sep 2021 17:01, Peter Stuge said:
> 
>> x11-ssh-askpass prompts wherever ssh-agent was started.
> 
> That is exactly what gpg-agent does for his ssh-agent functionality.
> Works for many people but fails as soon as you use an X-server to login
> to your work box (in my case a laptop).  Thus you either need to restart
> (ssh|gpg)-agent or you send the current set of envvars always to the
> agent.

Sounds like both gpg-agent and ssh-agent would benefit from Werner's proposal to pass environment variables to the agent.

An alternative idea to solve the same problem: Create an askpass protocol and use it to move the problem of interacting with the user to ssh. One way to do this would be to pass a file descriptor to the agent with each request. If the agent needs to interact with the user, it would write the question to the FD and wait for ssh to invoke askpass, get the response, and forward the response back to the agent. Problems with this idea:
   * Probably a lot more work (less pragmatic) than passing environment variables.
   * IIUC, the current ssh-agent protocol doesn't support passing file descriptors. A socket pathname could be passed instead.
   * Forwarding the askpass exchange to a remote host (so that the remote host is responsible for invoking the askpass binary to interact with the user) might be a bit tricky, so maybe it would be better to extend the ssh-agent protocol to add a new SSH_AGENT_ASKPASS response type. (ssh would need to tell the agent that it supports the new response type.)
   * Forwarding the askpass exchange to a remote host is problematic if the remote host is not fully trusted (e.g., users might not want to enter a PIN on the remote machine). There would need to be a way to configure ssh to forward the agent but not the askpass interactions. For safety, the default would be to not forward the askpass interactions even if the agent is forwarded.

-Richard