search

henn / qubes-app-split-ssh

Split SSH implementation for QubesOS
41 stars 20 forks source link

Use socat instead of ncat #8

Open reynir opened 6 years ago

reynir commented 6 years ago

socat seems to be more widely available. For example, the debian 9 template comes with socat, but nmap has to be installed in order to get ncat.

I might send a pull request if I get around to implementing this.

xaki23 commented 6 years ago

i am unsure how to turn this into a proper pull request, but the magic line for client (+vault) rc.local is ... 

    sudo -u user /bin/sh -c "umask 177 && exec socat -T 5 'UNIX-LISTEN:$SSH_SOCK,fork' 'EXEC:qrexec-client-vm $SSH_VAULT_VM qubes.SshAgent'" &

this fixes mutliple issues: a) the exec means the sudo process is not staying around. (cosmetic) b) the -T 5 means clients are shut down after 5 seconds of idle. (this fixes the very annoying concurrent-qrexec-sessions problem, and the ssh client doesnt care, it will create a new connection as needed if you are working f.ex. with agent forwarding) c) more cosmetics on the quoting style and where the ampersand goes.

HTH

xaki23 commented 6 years ago

yikes, TIL that the timeout is a bad idea for the vault-vm. ssh-add opens the agent socket right after start, and then is unwilling to reopen it if you take longer to type your passphrase (correctly) than the timeout duration.

so really long timeout (or no timeout) for the vault-adapter.