Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Register Machines: set up ssh key login to a compute machine (keychain-stored passphrase)

未关闭
  • 哪里不对？
#245 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
12/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
领域
authentication, security

调研方向

This is design work spanning key creation, OS keychains on three platforms, and remote authorized_keys handling, so start by reading the proposal and agreeing scope with maintainers via #204 and #194. The payload names the sshd test containers in tests/transport/sshd, plus the existing AuthCache, passdialog and login path that the one-time password copy must reuse. Done would mean a key-only login succeeds with no password prompt, re-running the button does not duplicate the key, and the centre-policy message is shown correctly.

由索引模型根据 Issue 内容生成。

描述

Goal

Make key-based ssh login to a compute machine (HPC cluster) easy to set up from Register Machines, so users do not type a password for every connection. Users must also not have to type a passphrase repeatedly.

Proposal

An opt-in button "Set up key login…" on the Connection tab of Register Machines. It is not done automatically.

  1. Key. If the user has no suitable key (~/.ssh/id_ed25519), create an ed25519 key with a passphrase.

  2. Passphrase storage. Store the passphrase in the operating system's keychain:

    • macOS Keychain
    • Windows Credential Manager
    • Secret Service / GNOME Keyring on Linux

    These unlock at desktop login, so in practice the passphrase is never typed again. Where no keychain is available, ECCE asks once per session and keeps it in memory (AuthCache), as it does for passwords today.

  3. Copy the public key. Log in once with the existing password login (ECCE's own ssh, AuthCache, passdialog), then append the public key to ~/.ssh/authorized_keys on the machine, as ssh-copy-id does:

    • create ~/.ssh with mode 700 and authorized_keys with mode 600;
    • do not add a key that is already present.

  4. Test. Try a key-only login and report the result plainly, including "the centre still requires a second factor".

Policies and limits

  • Centre policies. Some centres forbid keys without a passphrase. Others accept keys only through their own portal, where authorized_keys is ignored. The dialog states this and can show a link given in the site configuration for that machine.
  • Two-factor centres. At centres with a second factor, a key may replace the password but not the code. ECCE already logs in once per job (824b6262), not once per stream.
  • No passphrase-less default. Passphrase-less keys are not created by default. A deliberate choice for lab or shared accounts is possible, with a plain warning.
  • Standard key location. The key lives in the standard ~/.ssh location on every platform, so other ssh tools can use it.

Security

  • The private key and passphrase never leave the user's computer.
  • No credential is written to logs or temporary files.
  • The password used for the one-time copy goes through the existing login path only.

Tests

  • The sshd test containers (tests/transport/sshd): password-only and keyboard-interactive servers. After set-up, a key login succeeds and the password is not asked.
  • A centre that ignores authorized_keys is reported correctly.
  • Running the button again does not duplicate the key.
  • Keychain round trip on Linux CI (Secret Service), with macOS/Windows keychain access checked in their CI jobs.

Related: #204 (transport), #194 (credentials), first-start question #240.

主要语言
C
星标
10
派生
8
平均合并
21 分钟
30 天内合并 PR
1

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

FriendsofECCE/ECCE 的其他 Issue

查看 FriendsofECCE/ECCE 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。