mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3954] ssh: cannot access ssh-agent when doing a proxyjump #2475
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2475
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Lesstat on GitHub (Feb 7, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3954
Bug and expected behavior
If I try to connect to a host via ssh for which proxyjump is configured in the
.ssh/configfile, my configured ssh-agent is not used and I get asked for a password every time. After entering the password for the ssh-key, I get connected fine. I use a custom ssh-agent socket location as in #3884 and the fix suggested in that issues helps for hosts without configured proxyjump.I expect the ssh-agent to be used even for a proxyjump host.
No profile and disabling firejail
firejail --noprofile /path/to/programin a terminal?When running
firejail --noprofile ssh host:The password is asked twice.
which <program>orfirejail --listwhile the sandbox is running)?When running
/usr/bin/ssh host:I am logged in without needing to type a password
Reproduce
Steps to reproduce the behavior:
Environment
lsb_release -a,screenfetchorcat /etc/os-release)firejail --version) exclusive or used git commit (git rev-parse HEAD)Compile time support:
- AppArmor support is enabled
- AppImage support is enabled
- chroot support is enabled
- D-BUS proxy support is enabled
- file and directory whitelisting support is enabled
- file transfer support is enabled
- firetunnel support is enabled
- networking support is enabled
- overlayfs support is enabled
- private-home support is enabled
- SELinux support is disabled
- user namespace support is enabled
- X11 sandboxing support is enabled
Additional context
I use the gpg-agent as ssh-agent on a non default location. The gpg-agent does not run inside firejail. Both the host and the proxyjump can be accessed with the same ssh key.
Checklist
https://github.com/netblue30/firejail/issues/1139)--profile=PROFILENAMEis used to set the right profile.LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAMto get english error-messages.browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.debug output
@ghost commented on GitHub (Feb 7, 2021):
From your debug output:
Reading profile /home/flo/.config/firejail/ssh.profile
[...]
Please post that file here. As this is not a local override (ssh.local) but a complete replacement of our default /etc/firejail/ssh.profile it's rather hard to debug this without eyes on it. We just need to make sure your (self-made?) profile is not interfering and is working as expected.
@Lesstat commented on GitHub (Feb 7, 2021):
The contents of
/home/flo/.config/firejail/ssh.profileare:@ghost commented on GitHub (Feb 7, 2021):
Looks like a path that changes per invocation. We have
globbingsupport in whitelist now, so it might be wise to use that instead of hardcoding it:@Lesstat commented on GitHub (Feb 7, 2021):
Thanks a lot for that tip! I fixed in my setup, which makes me happy because the profile is cleaner. Unfortunately, the problem remains the same after the fix