diff --git a/doc/README-GPG.md b/doc/README-GPG.md index 96efc34..0cb4b19 100644 --- a/doc/README-GPG.md +++ b/doc/README-GPG.md @@ -5,7 +5,7 @@ and please let me [know](https://github.com/romanz/trezor-agent/issues/new) if s work well for you. If possible: * record the session (e.g. using [asciinema](https://asciinema.org)) - * attach the GPG agent log from `~/.gnupg/{trezor,ledger}/gpg-agent.log` + * attach the GPG agent log from `~/.gnupg/{trezor,ledger}/gpg-agent.log` (can be [encrypted](https://keybase.io/romanz)) Thanks! diff --git a/doc/README-SSH.md b/doc/README-SSH.md index 89ed67c..fa94c43 100644 --- a/doc/README-SSH.md +++ b/doc/README-SSH.md @@ -115,3 +115,55 @@ Note that your local SSH configuration may ignore `trezor-agent`, if it has `Ide If you are failing to connect, try running: $ trezor-agent -vv user@host -- ssh -vv -oIdentitiesOnly=no user@host + +# Start the agent as a systemd unit + +##### 1. Create these files in `~/.config/systemd/user` + +Replace `trezor` with `keepkey` or `ledger` as required. + +###### `trezor-ssh-agent.service` + +```` +[Unit] +Description=trezor-agent SSH agent +Requires=trezor-ssh-agent.socket + +[Service] +Type=Simple +ExecStart=/usr/bin/trezor-agent --foreground --sock-path %t/trezor-agent/S.ssh IDENTITY +```` + +Replace `IDENTITY` with the identity you used when exporting the public key. + +###### `trezor-ssh-agent.socket` + +```` +[Unit] +Description=trezor-agent SSH agent socket + +[Socket] +ListenStream=%t/trezor-agent/S.ssh +FileDescriptorName=ssh +Service=trezor-ssh-agent.service +SocketMode=0600 +DirectoryMode=0700 + +[Install] +WantedBy=sockets.target +```` + +##### 2. Run + +``` +systemctl --user start trezor-ssh-agent.service trezor-ssh-agent.socket +systemctl --user enable trezor-ssh-agent.socket +``` + +##### 3. Add this line to your `.bashrc` or equivalent file: + +```bash +export SSH_AUTH_SOCK=$(systemctl show --user --property=Listen trezor-ssh-agent.socket | grep -o "/run.*") +``` + +##### 4. SSH will now automatically use your device key in all terminals. diff --git a/libagent/device/trezor.py b/libagent/device/trezor.py index 7440e21..5d7cccf 100644 --- a/libagent/device/trezor.py +++ b/libagent/device/trezor.py @@ -57,21 +57,25 @@ class Trezor(interface.Device): cli_handler = conn.callback_PinMatrixRequest def new_handler(msg): - if _is_open_tty(sys.stdin): - result = cli_handler(msg) # CLI-based PIN handler - else: - scrambled_pin = _message_box( - 'Use the numeric keypad to describe number positions.\n' - 'The layout is:\n' - ' 7 8 9\n' - ' 4 5 6\n' - ' 1 2 3\n' - 'Please enter PIN:') - result = self._defs.PinMatrixAck(pin=scrambled_pin) - if not set(result.pin).issubset('123456789'): - raise self._defs.PinException( - None, 'Invalid scrambled PIN: {!r}'.format(result.pin)) - return result + try: + if _is_open_tty(sys.stdin): + result = cli_handler(msg) # CLI-based PIN handler + else: + scrambled_pin = _message_box( + 'Use the numeric keypad to describe number positions.\n' + 'The layout is:\n' + ' 7 8 9\n' + ' 4 5 6\n' + ' 1 2 3\n' + 'Please enter PIN:') + result = self._defs.PinMatrixAck(pin=scrambled_pin) + if not set(result.pin).issubset('123456789'): + raise self._defs.PinException( + None, 'Invalid scrambled PIN: {!r}'.format(result.pin)) + return result + except: # noqa + conn.init_device() + raise conn.callback_PinMatrixRequest = new_handler @@ -81,20 +85,24 @@ class Trezor(interface.Device): cli_handler = conn.callback_PassphraseRequest def new_handler(msg): - if self.__class__.cached_passphrase_ack: - log.debug('re-using cached %s passphrase', self) - return self.__class__.cached_passphrase_ack - - if _is_open_tty(sys.stdin): - # use CLI-based PIN handler - ack = cli_handler(msg) - else: - passphrase = _message_box('Please enter passphrase:') - passphrase = mnemonic.Mnemonic.normalize_string(passphrase) - ack = self._defs.PassphraseAck(passphrase=passphrase) - - self.__class__.cached_passphrase_ack = ack - return ack + try: + if self.__class__.cached_passphrase_ack: + log.debug('re-using cached %s passphrase', self) + return self.__class__.cached_passphrase_ack + + if _is_open_tty(sys.stdin): + # use CLI-based PIN handler + ack = cli_handler(msg) + else: + passphrase = _message_box('Please enter passphrase:') + passphrase = mnemonic.Mnemonic.normalize_string(passphrase) + ack = self._defs.PassphraseAck(passphrase=passphrase) + + self.__class__.cached_passphrase_ack = ack + return ack + except: # noqa + conn.init_device() + raise conn.callback_PassphraseRequest = new_handler diff --git a/libagent/gpg/__init__.py b/libagent/gpg/__init__.py index fa5091a..f9ba437 100644 --- a/libagent/gpg/__init__.py +++ b/libagent/gpg/__init__.py @@ -126,7 +126,11 @@ def run_init(device_type, args): homedir = os.path.expanduser('~/.gnupg/{}'.format(device_name)) log.info('GPG home directory: %s', homedir) - check_call(['rm', '-rf', homedir]) + if os.path.exists(homedir): + log.error('GPG home directory %s exists, ' + 'remove it manually if required', homedir) + sys.exit(1) + check_call(['mkdir', '-p', homedir]) check_call(['chmod', '700', homedir]) diff --git a/libagent/ssh/__init__.py b/libagent/ssh/__init__.py index ac54940..e378533 100644 --- a/libagent/ssh/__init__.py +++ b/libagent/ssh/__init__.py @@ -88,6 +88,8 @@ def create_agent_parser(device_type): g = p.add_mutually_exclusive_group() g.add_argument('-d', '--daemonize', default=False, action='store_true', help='Daemonize the agent and print its UNIX socket path') + g.add_argument('-f', '--foreground', default=False, action='store_true', + help='Run agent in foreground with specified UNIX socket path') g.add_argument('-s', '--shell', default=False, action='store_true', help=('run ${SHELL} as subprocess under SSH agent, allowing ' 'regular SSH-based tools to be used in the shell')) @@ -211,6 +213,17 @@ def _dummy_context(): yield +def _get_sock_path(args): + sock_path = args.sock_path + if not sock_path: + if args.foreground: + log.error('running in foreground mode requires specifying UNIX socket path') + sys.exit(1) + else: + sock_path = tempfile.mktemp(prefix='trezor-ssh-agent-') + return sock_path + + @handle_connection_error def main(device_type): """Run ssh-agent using given hardware client factory.""" @@ -232,9 +245,7 @@ def main(device_type): identity.identity_dict['proto'] = u'ssh' log.info('identity #%d: %s', index, identity.to_string()) - sock_path = args.sock_path - if not sock_path: - sock_path = tempfile.mktemp(prefix='trezor-ssh-agent-') + sock_path = _get_sock_path(args) command = args.command context = _dummy_context() @@ -248,6 +259,8 @@ def main(device_type): sys.stdout.flush() context = daemon.DaemonContext() log.info('running the agent as a daemon on %s', sock_path) + elif args.foreground: + log.info('running the agent on %s', sock_path) use_shell = bool(args.shell) if use_shell: @@ -258,7 +271,7 @@ def main(device_type): conn_factory=lambda: client.Client(device_type()), identities=identities, public_keys=public_keys) - if command or args.daemonize: + if command or args.daemonize or args.foreground: with context: return run_server(conn=conn, command=command, sock_path=sock_path, debug=args.debug, timeout=args.timeout)