PowerShell / PowerShell/Win32-OpenSSH
ssh-askpass missing with PKCS11 use
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
"OpenSSH for Windows" version
8.9.1.0
Client OperatingSystem
Windows 10 Enterprise
What is failing
When leveraging certificate based authentication, I am unable to get a prompt when accessing the card. I believe this lies in the fact that there is no ssh-askpass as there is in linux. In pathnames.h line 124 I see reference to ssh-askpass with a linux pathing, but not matching line for win32.
The certificate authentication works, and agent forwarding is functional but I would like to get a prompt when accessing the card for security purposes. If I use OpenSSH with Pageant and wsl-ssh-pageant (https://github.com/benpye/wsl-ssh-pageant) I can configure it to prompt (yes/no) on card access.
Expected output
Prompt for Smart Card use, either a yes/no prompt or PIN input.
step 1
ssh-add -c -s 'C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll'
Enter passphrase for PKCS#11: ********
step2
ssh- A host.fqdn -l someuser
step 3
some sort of dialogue box with focus prompting for card use (yes/no) or PIN prompt as ssh-askpass works on Linux
Actual output
no dialogue box, forwarding of cert works. I see the private key in the slot being accessed on my yubikey by it blinking
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at pathnames.h line 124 and trace how the Win32 build handles ssh-askpass during PKCS#11 certificate use. Reproduce the issue with the supplied ssh-add and SSH commands, then verify that card access produces a focused yes/no or PIN dialogue instead of only forwarding the certificate.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100