SSH Agent: Add SSH_AUTH_SOCK override and connection test

[hifi]

In issue #3683 and many others, the agent socket path environment variable is either missing or wrong in KeePassXC. Added a view to current effective environment variable and an override field to set a static path if so desired.

This work has been kindly supported by my employer, Vincit.

Type of change

• ✅ New feature (non-breaking change which adds functionality)

Description and Context

Fixes #3795

Screenshots

Testing strategy

Manual testing on Linux. Manual testing of agent connection test on Windows against Pageant and OpenSSH for Windows. Possibly needs to be tested on macOS but it should be fine.

Checklist:

• ✅ I have read the CONTRIBUTING document. [REQUIRED]
• ✅ My code follows the code style of this project. [REQUIRED]
• ✅ All new and existing tests passed. [REQUIRED]

[Kusoneko]

Just built and installed it on Arch Linux, it seems to work -- doesn't complain about ssh-agent not running once I gave it what my terminal's echo $SSH_AUTH_SOCK returns.

Edit: I might have been a bit too quick to talk, SSH doesn't seem to work at all for some reason. I tried git push and shh into my server and both tell me:

sign_and_send_pubkey: signing failed: agent refused operation
[email protected]: Permission denied (publickey).

I'm gonna go try to figure out why that happens.

Edit: I think I figured out what's happening. Every SSH key you add and set up in KeepassXC creates a KeeAgent.settings file in ~/.ssh thing is, if you have 2 SSH keys, that means the later one overwrites the former. I tried removing the file entirely from the SSH key entries in Edit Entry > Advanced > Attachment and if you do so, then in Edit Entry > SSH Agent Every settings you put up gets wiped out entirely. I'm gonna look into trying to rename the KeeAgent.settings file for each SSH key and see how that goes.

-- Note that it would be better if the KeeAgent.settings file was instead getting appended with any new keys added rather than completely replaced.

Final Edit: Nevermind, apparently I had badly setup the SSH Agent settings for the entries, after redoing them and restarting this KeepassXC version, both git and ssh stopped complaining and it worked fine. Both of my previous edits can be ignored.

[hifi]

It was a wild ride to read for sure! Raised my eyebrows when I read KeeAgent.settings file being created in ~/.ssh.

Good you got it working in the end.

[Kusoneko]

Yeah, I have absolutely no clue how that KeeAgent.settings file appeared there. I think I deleted it from there and nothing broke, so it's likely that I accidentally opened it from one of the attachments and then saved it there or something and forgot about it. The SSH Agent settings for the entries though that are a problem is if you set up the path to the private key in external file, everything works fine, if you add the private key as an attachment and use that, instead of the external file setting on the SSH Agent page of entries, it doesn't work. I'm not sure why exactly. I was figuring if the SSH private key and the password are in the database, then ssh-ing into stuff would be even easier... But now that I think about it, ssh-agent would need to know what private key you're talking about and "it's inside this kbdx file" likely isn't a valid answer. I'm thinking the point of attaching it is that if you move to a different machine you have your ssh key in the db so you can pull it out and use it normally.

[hifi]

When a key is loaded into ssh-agent process the private key is sent over wire so KeePassXC will send it regardless where it is actually stored. If you use an external attachment then it will read it, optionally decrypt and then send it, if it's an attachment it will read that instead and send it.

Some people prefer to keep the key file external and only keep its passphrase in the KDBX file. I use an attachment so I don't need to move the key file around as it comes and works with the database as-is.

[Kusoneko]

Hmmm, it's odd that it didn't work as attachments but did as external files then.

Edit: I think I figured out why it didn't work as attachments but I'm not sure how to fix it. In ~/.ssh/config, I mention for each host which private key to use with the IdentityFile setting, except, how do I do that if it's a KeepassXC Entry attachment? Should I just do away with the config file entirely and instead in KeepassXC make an entry for each host with the user as username and ssh:// link as URL? That might get old quick though cause then I'd have multiple entries for the same SSH key that's shared on multiple Hosts, and I'm not sure how it handles the variety of ways to call git over ssh? ( git@host:user/repo.git, ssh://host/path/to/repo.git, and so on...)

[hifi]

You can use an exported public key as the IdentityFile. It's not documented but it works.

[Kusoneko]

Interesting. I'm gonna try that, I'm curious.

Nope, using a public key as the IdentityFile doesn't work any better. I get the following error message:

sign_and_send_pubkey: signing failed: agent refused operation
[email protected]: Permission denied (publickey).

Same as I'd get if I continued using the private key as the IdentityFile.

[hifi]

"agent refused operation" usually means you have a constraint enabled when adding a key that cannot be fulfilled at the time you are using the key. Check that you don't have any constraints enabled on KeePassXC end for the entry and try again.

[Kusoneko]

What constraints? Where do I find those?

[hifi]

The constraints are the usage limits per key like require confirmation before use. That for one requires an "ask pass" implementation and if for some reason it can't be launched by the agent it will just refuse to work.