<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<meta name="Generator" content="Kopano WebApp v8.4.90">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>RE: Allowing xfce4-session to use external ssh-agent</title>
</head>
<body>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;"><br /></span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;"><br /></span></p>
<blockquote style="border-left: 2px solid #325fba; padding-left: 5px; margin: 0px 5px 1em;"><span style="font-family: tahoma,arial,helvetica,sans-serif; font-size: 10pt;">-----Original message-----<br /><span><strong>From:</strong> Yves-Alexis Perez <corsac@debian.org></span><br /><span><strong>Sent:</strong> Sunday, November 19, 2017 7:46 PM</span><br /><span><strong>To:</strong> Xfce development list <xfce4-dev@xfce.org></span><br /><span><strong>Subject:</strong> Re: Allowing xfce4-session to use external ssh-agent</span><br /><br /></span>
<div>
<pre style="white-space: pre-wrap; word-wrap: break-word;">On Sun, 2017-11-19 at 02:51 +0200, Ivan Kabaivanov wrote:<br />> xfconf-query -c xfce4-session -p /startup/ssh-agent/external -n -t string -s<br />> true<br />> xfconf-query -c xfce4-session -p /startup/ssh-agent/external_socket -n -t<br />> string -s PATH_TO_SSH_SOCKET<br /><br />What if you just set:<br /><br />xfconf-query -c xfce4-session -p /startup/ssh-agent/enabled<br />false<br /><br />Afaict it works just fine here (ssh-agent is gpg-agent here, so not managed by<br />xfce4-session).<br /></pre>
</div>
</blockquote>
<p style="padding: 0; margin: 0;"></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;"><br /></span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;">Unfortunately this will not work as xfce will not be aware of the existing ssh-agent socket and will not export SSH_AUTH_SOCK to apps started within the xfce4-session.</span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;"><br /></span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;">Right now we have three options:</span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;">1) Disable both ssh-agent and pgp-agent -- in this case SSH_AUTH_SOCK will be undefined and apps looking for it will not use the manually started ssh-agent (or pgp-agent for that matter)</span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;">2) Enable ssh-agent and it will be used even if pgp-agent is enabled -- only apps started within xfce will be able to use ssh-agent</span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;">3) Enable pgp-agent and disable ssh-agent -- only apps started within xfce will be able to use ssh-agent</span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;"><br /></span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;">What I'm proposing is a fourth option -- "attach" xfce4-session to an existing ssh-agent socket and export SSH_AUTH_SOCK to all apps within the xfce4-session. Non-xfce apps will also see SSH_AUTH_SOCK as we export it via .bashrc (or whatever you prefer, systemd user unit, custom script, etc).</span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;"><br /></span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;">Full disclosure: I'm using LFS (Linux From Scratch) so I suspect major distros probably have a workaround to expose the same SSH_AUTH_SOCK to both xfce and non-xfce apps.</span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;"><br /></span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;">Thanks,</span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;">IvanK.</span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;"><br /></span></p>
<p style="padding: 0; margin: 0;"><span style="font-size: 10pt; font-family: tahoma, arial, helvetica, sans-serif;"><br /></span></p>
<blockquote style="border-left: 2px solid #325fba; padding-left: 5px; margin: 1em 5px 0px;">
<div>
<pre style="white-space: pre-wrap; word-wrap: break-word;"><br />Regards,<br />-- <br />Yves-Alexis_______________________________________________<br />Xfce4-dev mailing list<br />Xfce4-dev@xfce.org<br />https://mail.xfce.org/mailman/listinfo/xfce4-dev</pre>
</div>
</blockquote>
</body>
</html>