mirror of
https://github.com/Matir/skel.git
synced 2026-07-24 13:16:56 -07:00
Improve SSH_AUTH_SOCK handling.
This commit is contained in:
David Tomaschik
263
dotfiles/shenv
263
dotfiles/shenv
@@ -97,143 +97,160 @@ export LVM_SUPPRESS_FD_WARNINGS=1
|
|||||||
export EARTHLY_SSH_AUTH_SOCK=""
|
export EARTHLY_SSH_AUTH_SOCK=""
|
||||||
|
|
||||||
# Handle SSH_AUTH_SOCK for tmux consistency
|
# Handle SSH_AUTH_SOCK for tmux consistency
|
||||||
_SSH_AUTH_LINK="${HOME}/.ssh/ssh_auth_sock"
|
case "$-" in
|
||||||
|
*i*)
|
||||||
|
_SSH_AUTH_LINK="${HOME}/.ssh/ssh_auth_sock"
|
||||||
|
|
||||||
# Helper to check if a path is our link or points to it
|
# Helper to check if a path is our link or points to it
|
||||||
_is_link_path() {
|
_is_link_path() {
|
||||||
[ -z "$1" ] && return 1
|
[ -z "$1" ] && return 1
|
||||||
_target="${_SSH_AUTH_LINK:-${HOME}/.ssh/ssh_auth_sock}"
|
_target="${_SSH_AUTH_LINK:-${HOME}/.ssh/ssh_auth_sock}"
|
||||||
[ "$1" = "${_target}" ] && { unset -v _target; return 0; }
|
[ "$1" = "${_target}" ] && { unset -v _target; return 0; }
|
||||||
if [ -L "$1" ] && command -v readlink >/dev/null 2>&1; then
|
if [ -L "$1" ] && command -v readlink >/dev/null 2>&1; then
|
||||||
_T=$(readlink "$1")
|
_T=$(readlink "$1")
|
||||||
# Handle relative symlinks
|
# Handle relative symlinks
|
||||||
case "${_T}" in /*) ;; *) _T="$(dirname "$1")/${_T}" ;; esac
|
case "${_T}" in /*) ;; *) _T="$(dirname "$1")/${_T}" ;; esac
|
||||||
[ "${_T}" = "${_target}" ] && { unset -v _target _T; return 0; }
|
[ "${_T}" = "${_target}" ] && { unset -v _target _T; return 0; }
|
||||||
unset -v _T
|
unset -v _T
|
||||||
fi
|
|
||||||
unset -v _target
|
|
||||||
return 1
|
|
||||||
}
|
|
||||||
|
|
||||||
# Helper to check if an SSH socket is valid and useful via ssh-add return codes
|
|
||||||
_is_valid_ssh_sock() {
|
|
||||||
[ -z "$1" ] && return 1
|
|
||||||
[ -S "$1" ] || return 1
|
|
||||||
if command -v ssh-add >/dev/null 2>&1; then
|
|
||||||
SSH_AUTH_SOCK="$1" ssh-add -l >/dev/null 2>&1
|
|
||||||
case "$?" in
|
|
||||||
0|1) return 0 ;;
|
|
||||||
*) return 1 ;;
|
|
||||||
esac
|
|
||||||
fi
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
|
|
||||||
# Function to get the path to the socket for the local ssh-agent
|
|
||||||
get_local_ssh_agent_sock() {
|
|
||||||
_found=""
|
|
||||||
if [ "$(uname)" = "Darwin" ]; then
|
|
||||||
_found=$(launchctl getenv SSH_AUTH_SOCK 2>/dev/null)
|
|
||||||
elif command -v systemctl >/dev/null 2>&1; then
|
|
||||||
# Query systemd socket units directly to avoid environment overrides.
|
|
||||||
for _u in ssh-agent.socket openssh-agent.socket gcr-ssh-agent.socket gpg-agent-ssh.socket; do
|
|
||||||
_p=$(systemctl --user show "${_u}" -p Listen 2>/dev/null | cut -d= -f2- | cut -d' ' -f1)
|
|
||||||
if ! _is_link_path "${_p}" && _is_valid_ssh_sock "${_p}"; then
|
|
||||||
_found="${_p}"
|
|
||||||
break
|
|
||||||
fi
|
fi
|
||||||
done
|
unset -v _target
|
||||||
# Fallback to systemd environment
|
return 1
|
||||||
if [ -z "${_found}" ] || _is_link_path "${_found}" || ! _is_valid_ssh_sock "${_found}"; then
|
}
|
||||||
_found=$(systemctl --user show-environment 2>/dev/null | grep "^SSH_AUTH_SOCK=" | cut -d= -f2-)
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ -n "${_found}" ] && ! _is_link_path "${_found}" && _is_valid_ssh_sock "${_found}"; then
|
# Helper to check if an SSH socket is valid and useful
|
||||||
echo "${_found}"
|
_is_valid_ssh_sock() {
|
||||||
unset -v _found _u _p
|
[ -z "$1" ] && return 1
|
||||||
return 0
|
[ -S "$1" ] || return 1
|
||||||
fi
|
|
||||||
|
|
||||||
# Search common fallback paths
|
if command -v nc >/dev/null 2>&1; then
|
||||||
_u=$(id -u)
|
# Use nc to quickly check if the socket is listening.
|
||||||
for _p in "/run/user/${_u}/keyring/ssh" "/run/user/${_u}/ssh-agent.socket" "/run/user/${_u}/openssh_agent" "/run/user/${_u}/gnupg/S.gpg-agent.ssh"; do
|
# We use -N to shutdown the socket after EOF on stdin (for OpenBSD netcat compatibility).
|
||||||
if ! _is_link_path "${_p}" && _is_valid_ssh_sock "${_p}"; then
|
if echo '' | nc -w 1 -N -U "$1" >/dev/null 2>&1; then
|
||||||
echo "${_p}"
|
return 0
|
||||||
unset -v _found _u _p
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if command -v ssh-add >/dev/null 2>&1; then
|
||||||
|
SSH_AUTH_SOCK="$1" ssh-add -l >/dev/null 2>&1
|
||||||
|
case "$?" in
|
||||||
|
0|1) return 0 ;;
|
||||||
|
*) return 1 ;;
|
||||||
|
esac
|
||||||
|
fi
|
||||||
|
|
||||||
|
if command -v nc >/dev/null 2>&1; then
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
return 0
|
return 0
|
||||||
fi
|
}
|
||||||
done
|
|
||||||
|
|
||||||
# Search /run/user/UID and /tmp for agent.* sockets
|
# Function to get the path to the socket for the local ssh-agent
|
||||||
_search=""
|
get_local_ssh_agent_sock() {
|
||||||
for _d in "/run/user/${_u}" /tmp; do [ -d "${_d}" ] && _search="${_search} ${_d}"; done
|
_found=""
|
||||||
if [ -n "${_search}" ]; then
|
if [ "$(uname)" = "Darwin" ]; then
|
||||||
for _p in $(find ${_search} -maxdepth 2 -type s -name 'agent.*' 2>/dev/null); do
|
_found=$(launchctl getenv SSH_AUTH_SOCK 2>/dev/null)
|
||||||
if ! _is_link_path "${_p}" && _is_valid_ssh_sock "${_p}"; then
|
elif command -v systemctl >/dev/null 2>&1; then
|
||||||
echo "${_p}"
|
# Query systemd socket units directly to avoid environment overrides.
|
||||||
unset -v _found _u _p _search _d
|
for _u in ssh-agent.socket openssh-agent.socket gcr-ssh-agent.socket gpg-agent-ssh.socket; do
|
||||||
|
_p=$(systemctl --user show "${_u}" -p Listen 2>/dev/null | cut -d= -f2- | cut -d' ' -f1)
|
||||||
|
if ! _is_link_path "${_p}" && _is_valid_ssh_sock "${_p}"; then
|
||||||
|
_found="${_p}"
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
# Fallback to systemd environment
|
||||||
|
if [ -z "${_found}" ] || _is_link_path "${_found}" || ! _is_valid_ssh_sock "${_found}"; then
|
||||||
|
_found=$(systemctl --user show-environment 2>/dev/null | grep "^SSH_AUTH_SOCK=" | cut -d= -f2-)
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -n "${_found}" ] && ! _is_link_path "${_found}" && _is_valid_ssh_sock "${_found}"; then
|
||||||
|
echo "${_found}"
|
||||||
|
unset -v _found _u _p
|
||||||
return 0
|
return 0
|
||||||
fi
|
fi
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
unset -v _found _u _p _search _d
|
# Search common fallback paths
|
||||||
return 1
|
_u=$(id -u)
|
||||||
}
|
for _p in "/run/user/${_u}/keyring/ssh" "/run/user/${_u}/ssh-agent.socket" "/run/user/${_u}/openssh_agent" "/run/user/${_u}/gnupg/S.gpg-agent.ssh"; do
|
||||||
|
if ! _is_link_path "${_p}" && _is_valid_ssh_sock "${_p}"; then
|
||||||
|
echo "${_p}"
|
||||||
|
unset -v _found _u _p
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
# Function to reset SSH_AUTH_SOCK to the local ssh-agent
|
# Search /run/user/UID and /tmp for agent.* sockets
|
||||||
reset_ssh_socket() {
|
_search=""
|
||||||
_rss_sock=$(get_local_ssh_agent_sock)
|
for _d in "/run/user/${_u}" /tmp; do [ -d "${_d}" ] && _search="${_search} ${_d}"; done
|
||||||
if [ -n "${_rss_sock}" ]; then
|
if [ -n "${_search}" ]; then
|
||||||
_rss_link="${HOME}/.ssh/ssh_auth_sock"
|
for _p in $(find ${_search} -maxdepth 2 -type s -name 'agent.*' 2>/dev/null); do
|
||||||
mkdir -p "$(dirname "${_rss_link}")"
|
if ! _is_link_path "${_p}" && _is_valid_ssh_sock "${_p}"; then
|
||||||
ln -sf "${_rss_sock}" "${_rss_link}"
|
echo "${_p}"
|
||||||
export SSH_AUTH_SOCK="${_rss_link}"
|
unset -v _found _u _p _search _d
|
||||||
if command -v systemctl >/dev/null 2>&1; then
|
return 0
|
||||||
systemctl --user set-environment SSH_AUTH_SOCK="${_rss_link}" 2>/dev/null
|
fi
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
unset -v _found _u _p _search _d
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# Function to reset SSH_AUTH_SOCK to the local ssh-agent
|
||||||
|
reset_ssh_socket() {
|
||||||
|
_rss_sock=$(get_local_ssh_agent_sock)
|
||||||
|
if [ -n "${_rss_sock}" ]; then
|
||||||
|
_rss_link="${HOME}/.ssh/ssh_auth_sock"
|
||||||
|
mkdir -p "$(dirname "${_rss_link}")"
|
||||||
|
ln -sf "${_rss_sock}" "${_rss_link}"
|
||||||
|
export SSH_AUTH_SOCK="${_rss_link}"
|
||||||
|
if command -v systemctl >/dev/null 2>&1; then
|
||||||
|
systemctl --user set-environment SSH_AUTH_SOCK="${_rss_link}" 2>/dev/null
|
||||||
|
fi
|
||||||
|
echo "Reset SSH_AUTH_SOCK to ${_rss_link} -> ${_rss_sock}"
|
||||||
|
unset -v _rss_sock _rss_link
|
||||||
|
return 0
|
||||||
|
else
|
||||||
|
echo "reset_ssh_socket: no valid local ssh-agent socket found." >&2
|
||||||
|
unset -v _rss_sock
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
_CANDIDATE=""
|
||||||
|
|
||||||
|
# 1. If current environment has a valid socket that is NOT our link, it's a prime candidate
|
||||||
|
# (e.g. fresh SSH login: sshd sets SSH_AUTH_SOCK to the raw forwarded socket before ssh/rc
|
||||||
|
# rewrites it to the stable symlink; the shell inherits the original raw path).
|
||||||
|
if ! _is_link_path "${SSH_AUTH_SOCK:-}" && _is_valid_ssh_sock "${SSH_AUTH_SOCK:-}"; then
|
||||||
|
_CANDIDATE="${SSH_AUTH_SOCK}"
|
||||||
fi
|
fi
|
||||||
echo "Reset SSH_AUTH_SOCK to ${_rss_link} -> ${_rss_sock}"
|
|
||||||
unset -v _rss_sock _rss_link
|
|
||||||
return 0
|
|
||||||
else
|
|
||||||
echo "reset_ssh_socket: no valid local ssh-agent socket found." >&2
|
|
||||||
unset -v _rss_sock
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
_CANDIDATE=""
|
# 2. Only look for a system agent if the stable link is already broken. If the link is
|
||||||
|
# valid (e.g. a tmux pane where SSH_AUTH_SOCK points to our symlink which ssh/rc just
|
||||||
|
# updated to the forwarded socket), leave it alone — don't clobber it with a local agent.
|
||||||
|
if [ -z "${_CANDIDATE}" ] && ! _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
|
||||||
|
_CANDIDATE=$(get_local_ssh_agent_sock)
|
||||||
|
fi
|
||||||
|
|
||||||
# 1. If current environment has a valid socket that is NOT our link, it's a prime candidate
|
# 3. Sync the stable link if we found a valid "real" socket.
|
||||||
# (e.g. fresh SSH login: sshd sets SSH_AUTH_SOCK to the raw forwarded socket before ssh/rc
|
if [ -n "${_CANDIDATE}" ] && ! _is_link_path "${_CANDIDATE}" && _is_valid_ssh_sock "${_CANDIDATE}"; then
|
||||||
# rewrites it to the stable symlink; the shell inherits the original raw path).
|
mkdir -p "$(dirname "${_SSH_AUTH_LINK}")"
|
||||||
if ! _is_link_path "${SSH_AUTH_SOCK:-}" && _is_valid_ssh_sock "${SSH_AUTH_SOCK:-}"; then
|
ln -sf "${_CANDIDATE}" "${_SSH_AUTH_LINK}"
|
||||||
_CANDIDATE="${SSH_AUTH_SOCK}"
|
export SSH_AUTH_SOCK="${_SSH_AUTH_LINK}"
|
||||||
fi
|
# Update systemd if present to keep everything in sync
|
||||||
|
if command -v systemctl >/dev/null 2>&1; then
|
||||||
|
systemctl --user set-environment SSH_AUTH_SOCK="${_SSH_AUTH_LINK}" 2>/dev/null
|
||||||
|
fi
|
||||||
|
elif _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
|
||||||
|
# If we found nothing better but the link is valid, use it.
|
||||||
|
export SSH_AUTH_SOCK="${_SSH_AUTH_LINK}"
|
||||||
|
fi
|
||||||
|
|
||||||
# 2. Only look for a system agent if the stable link is already broken. If the link is
|
unset _SSH_AUTH_LINK _CANDIDATE
|
||||||
# valid (e.g. a tmux pane where SSH_AUTH_SOCK points to our symlink which ssh/rc just
|
;;
|
||||||
# updated to the forwarded socket), leave it alone — don't clobber it with a local agent.
|
esac
|
||||||
if [ -z "${_CANDIDATE}" ] && ! _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
|
|
||||||
_CANDIDATE=$(get_local_ssh_agent_sock)
|
|
||||||
fi
|
|
||||||
|
|
||||||
# 3. Sync the stable link if we found a valid "real" socket.
|
|
||||||
if [ -n "${_CANDIDATE}" ] && ! _is_link_path "${_CANDIDATE}" && _is_valid_ssh_sock "${_CANDIDATE}"; then
|
|
||||||
mkdir -p "$(dirname "${_SSH_AUTH_LINK}")"
|
|
||||||
ln -sf "${_CANDIDATE}" "${_SSH_AUTH_LINK}"
|
|
||||||
export SSH_AUTH_SOCK="${_SSH_AUTH_LINK}"
|
|
||||||
# Update systemd if present to keep everything in sync
|
|
||||||
if command -v systemctl >/dev/null 2>&1; then
|
|
||||||
systemctl --user set-environment SSH_AUTH_SOCK="${_SSH_AUTH_LINK}" 2>/dev/null
|
|
||||||
fi
|
|
||||||
elif _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
|
|
||||||
# If we found nothing better but the link is valid, use it.
|
|
||||||
export SSH_AUTH_SOCK="${_SSH_AUTH_LINK}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
unset _SSH_AUTH_LINK _CANDIDATE
|
|
||||||
|
|
||||||
# Setup XDG-like dirs on MacOS
|
# Setup XDG-like dirs on MacOS
|
||||||
# Based on https://leebyron.com/til/mac-xdg/
|
# Based on https://leebyron.com/til/mac-xdg/
|
||||||
|
|||||||
Reference in New Issue
Block a user