Register Machines: set up ssh key login to a compute machine (keychain-stored passphrase)
まだ誰も着手していません。
評価
- 難易度
- 5/5
- 見積もり時間
- 1週間以上
- 初心者へのやさしさ
- 12/100
- issue の種類
- 機能追加
- 明瞭さ
- おおむね明確
- 活発さ
- 活発
調査の方向性
This is design work spanning key creation, OS keychains on three platforms, and remote authorized_keys handling, so start by reading the proposal and agreeing scope with maintainers via #204 and #194. The payload names the sshd test containers in tests/transport/sshd, plus the existing AuthCache, passdialog and login path that the one-time password copy must reuse. Done would mean a key-only login succeeds with no password prompt, re-running the button does not duplicate the key, and the centre-policy message is shown correctly.
索引モデルが issue の本文から書いたものです。
説明
Goal
Make key-based ssh login to a compute machine (HPC cluster) easy to set up from Register Machines, so users do not type a password for every connection. Users must also not have to type a passphrase repeatedly.
Proposal
An opt-in button "Set up key login…" on the Connection tab of Register Machines. It is not done automatically.
-
Key. If the user has no suitable key (
~/.ssh/id_ed25519), create an ed25519 key with a passphrase. -
Passphrase storage. Store the passphrase in the operating system's keychain:
- macOS Keychain
- Windows Credential Manager
- Secret Service / GNOME Keyring on Linux
These unlock at desktop login, so in practice the passphrase is never typed again. Where no keychain is available, ECCE asks once per session and keeps it in memory (AuthCache), as it does for passwords today.
-
Copy the public key. Log in once with the existing password login (ECCE's own ssh, AuthCache, passdialog), then append the public key to
~/.ssh/authorized_keyson the machine, asssh-copy-iddoes:- create
~/.sshwith mode 700 andauthorized_keyswith mode 600; - do not add a key that is already present.
- create
-
Test. Try a key-only login and report the result plainly, including "the centre still requires a second factor".
Policies and limits
- Centre policies. Some centres forbid keys without a passphrase. Others accept keys only through their own portal, where
authorized_keysis ignored. The dialog states this and can show a link given in the site configuration for that machine. - Two-factor centres. At centres with a second factor, a key may replace the password but not the code. ECCE already logs in once per job (
824b6262), not once per stream. - No passphrase-less default. Passphrase-less keys are not created by default. A deliberate choice for lab or shared accounts is possible, with a plain warning.
- Standard key location. The key lives in the standard
~/.sshlocation on every platform, so other ssh tools can use it.
Security
- The private key and passphrase never leave the user's computer.
- No credential is written to logs or temporary files.
- The password used for the one-time copy goes through the existing login path only.
Tests
- The sshd test containers (
tests/transport/sshd): password-only and keyboard-interactive servers. After set-up, a key login succeeds and the password is not asked. - A centre that ignores
authorized_keysis reported correctly. - Running the button again does not duplicate the key.
- Keychain round trip on Linux CI (Secret Service), with macOS/Windows keychain access checked in their CI jobs.
Related: #204 (transport), #194 (credentials), first-start question #240.
- 主要言語
- C
- スター
- 10
- フォーク
- 8
- 平均マージ
- 21分
- マージ済み PR（30日）
- 1
環境構築
このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。
はじめの一歩
- issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
- 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
- リポジトリをフォークし、ブランチを切って変更します。
- issue 番号を参照したプルリクエストを送ります。
FriendsofECCE/ECCE のほかの issue
-
難易度 1/5 1時間未満 初心者へのやさしさ 70/100
FriendsofECCE/ECCE#353 ·
-
難易度 2/5 1〜3時間 初心者へのやさしさ 70/100
FriendsofECCE/ECCE#336 · コメント 1 件 ·
-
難易度 3/5 1〜2日 初心者へのやさしさ 45/100
FriendsofECCE/ECCE#355 ·
-
Icons in MacOSオープンenhancement
難易度 5/5 1週間以上 初心者へのやさしさ 18/100
FriendsofECCE/ECCE#354 · コメント 4 件 ·
-
難易度 3/5 1〜2日 初心者へのやさしさ 45/100
FriendsofECCE/ECCE#351 ·
FriendsofECCE/ECCE の issue をすべて見る
似ている issue
-
難易度 2/5 1〜3時間 初心者へのやさしさ 80/100
メンテナーはふだん 1 日以内に返信
-
base-files: 82_config_generate: regenerate /etc/board.json if 0-bytes / truncated after power cutオープン
難易度 2/5 1〜3時間 初心者へのやさしさ 72/100
openwrt/openwrt#25940 · コメント 5 件 ·
メンテナーはふだん 1 日以内に返信
-
難易度 2/5 1〜3時間 初心者へのやさしさ 70/100
-
難易度 2/5 1〜3時間 初心者へのやさしさ 70/100
-
難易度 2/5 1〜3時間 初心者へのやさしさ 66/100
FujiNetWIFI/fujinet-lib#186 ·
メンテナーはふだん 1 日以内に返信