[1774] in athena10
[Debathena] #162: Disable GNOME keyring prompt on SSH
daemon@ATHENA.MIT.EDU (Debathena Trac)
Thu Mar 19 15:29:16 2009
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
From: "Debathena Trac" <debathena@MIT.EDU>
Cc: debathena@mit.edu
To: geofft@mit.edu
Date: Thu, 19 Mar 2009 19:28:47 -0000
Reply-To:
Message-ID: <043.1bc7be2040fb63b9d7a0c1ec2914b09e@mit.edu>
Content-Transfer-Encoding: 8bit
#162: Disable GNOME keyring prompt on SSH-------------------+--------------------------------------------------------
Reporter: geofft | Owner:
Type: defect | Status: new
Priority: low | Keywords:
-------------------+-------------------------------------------------------- From mail to debathena@ on March 8, 2009:
If you try to use SSH on cluster machines and you have a GNOME keyring (I
don't know the conditions under which one would get created, but I have
one), you get an annoying popup asking you to unlock your keyring, which
is probably locked with an old Kerberos password. According to
http://live.gnome.org/GnomeKeyring/Ssh , you can disable the prompt by
setting the gconf key /apps/gnome-keyring/daemon-components/ssh to false.
This may affect people who do want to use an SSH agent, though.
Another option would be to figure out how to default gnome-keyring to not
encrypt the keyring, which is probably acceptable given AFS permissions.
This wouldn't help users who already have encrypted keyrings (unless we
tell them to rm
~/.gnome2/keyrings/*).
jdreed says we can just document how to do one of the above two options /
remove the keyring, or disable the SSH agent by default and document how
to enable it.
A third option is to make debathena-ssh-client-config cause ssh_config to
prefer Kerberos auth before public/private key auth. ghudson favors this
one, as do I. We can do this by setting our own list of
PreferredAuthentications, with GSSAPI before SSH keys.
-- Ticket URL: <http://debathena.mit.edu/trac/ticket/162>Debathena <http://debathena.mit.edu/>MIT Debian-Athena Project
