Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Register Machines: set up ssh key login to a compute machine (keychain-stored passphrase)

Offen
  • Stimmt etwas nicht?
#245 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Anfängerfreundlichkeit
12/100
Issue-Typ
Feature
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Bereich
authentication, security

Rechercherichtung

This is design work spanning key creation, OS keychains on three platforms, and remote authorized_keys handling, so start by reading the proposal and agreeing scope with maintainers via #204 and #194. The payload names the sshd test containers in tests/transport/sshd, plus the existing AuthCache, passdialog and login path that the one-time password copy must reuse. Done would mean a key-only login succeeds with no password prompt, re-running the button does not duplicate the key, and the centre-policy message is shown correctly.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Goal

Make key-based ssh login to a compute machine (HPC cluster) easy to set up from Register Machines, so users do not type a password for every connection. Users must also not have to type a passphrase repeatedly.

Proposal

An opt-in button "Set up key login…" on the Connection tab of Register Machines. It is not done automatically.

  1. Key. If the user has no suitable key (~/.ssh/id_ed25519), create an ed25519 key with a passphrase.

  2. Passphrase storage. Store the passphrase in the operating system's keychain:

    • macOS Keychain
    • Windows Credential Manager
    • Secret Service / GNOME Keyring on Linux

    These unlock at desktop login, so in practice the passphrase is never typed again. Where no keychain is available, ECCE asks once per session and keeps it in memory (AuthCache), as it does for passwords today.

  3. Copy the public key. Log in once with the existing password login (ECCE's own ssh, AuthCache, passdialog), then append the public key to ~/.ssh/authorized_keys on the machine, as ssh-copy-id does:

    • create ~/.ssh with mode 700 and authorized_keys with mode 600;
    • do not add a key that is already present.

  4. Test. Try a key-only login and report the result plainly, including "the centre still requires a second factor".

Policies and limits

  • Centre policies. Some centres forbid keys without a passphrase. Others accept keys only through their own portal, where authorized_keys is ignored. The dialog states this and can show a link given in the site configuration for that machine.
  • Two-factor centres. At centres with a second factor, a key may replace the password but not the code. ECCE already logs in once per job (824b6262), not once per stream.
  • No passphrase-less default. Passphrase-less keys are not created by default. A deliberate choice for lab or shared accounts is possible, with a plain warning.
  • Standard key location. The key lives in the standard ~/.ssh location on every platform, so other ssh tools can use it.

Security

  • The private key and passphrase never leave the user's computer.
  • No credential is written to logs or temporary files.
  • The password used for the one-time copy goes through the existing login path only.

Tests

  • The sshd test containers (tests/transport/sshd): password-only and keyboard-interactive servers. After set-up, a key login succeeds and the password is not asked.
  • A centre that ignores authorized_keys is reported correctly.
  • Running the button again does not duplicate the key.
  • Keychain round trip on Linux CI (Secret Service), with macOS/Windows keychain access checked in their CI jobs.

Related: #204 (transport), #194 (credentials), first-start question #240.

Vorherrschende Sprache
C
Sterne
10
Forks
8
Ø Merge
21 Min.
Gemergte PRs (30 T.)
1

Entwicklungsumgebung

Dieses Projekt bietet weder Dev-Container noch Dockerfile noch Beitragsleitfaden – die Einrichtung liegt bei Ihnen. Beginnen Sie mit der README; die allgemeinen Schritte stehen in unserem Leitfaden für den ersten Beitrag.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus FriendsofECCE/ECCE

Alle Issues in FriendsofECCE/ECCE

Ähnliche Issues

Weitere Issues zu C

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.