slices.Insert(cmd, 1, "-O", "check") writes into cmd's backing array
when there is spare capacity (cap(cmd) >= len(cmd)+2). check_cmd points
at the shifted array, but cmd's slice header is unchanged: reading
cmd[:insertion_point] later returns "-O", "check", ... where the
original prefix used to be. run_control_master, forward_remote_control,
and the final ssh exec all build their argvs from this corrupted prefix.
Repro: share_connections=yes, forward_remote_control=yes, and enough
ssh_args to push cmd past Go's slice-growth threshold (kitten ssh -v
host does it). With the ControlMaster already up you'll see
"Multiplexing command already specified"; otherwise it fails with
"Failed to start SSH ControlMaster" and a stray -O check left in the
cmdline.
This prevents sending attacker controlled data over the tty where it
might end up getting evaled by the shell if the user is doing something
like cat of unsanitized data into the terminal (something that should
never be done).
The overrides were not being passed to the askpass kitten.
And we dont need to support backward compatibility for secrets with no
backend, since this feature has never been released.
Motivation: Some environments disallow or do not reliably accept one-way
pubkey-only auth, or require keyboard-interactive password + TOTP. This adds an
optional, host-scoped automation via kitty's native askpass to reduce repetitive
manual entry while preserving the ssh kitten UX.
- Add auth_config.go to parse password/totp_* from ssh.conf by host block
- Ignore these keys in main ssh.conf parser to avoid bad-line warnings
- Pass host/user to askpass for host-aware lookup
- Auto-answer password and OTP prompts in askpass; fallback to UI otherwise
Security: Secrets in ssh.conf are plain text; users should enforce strict
permissions or avoid storing passwords if unacceptable. Only login password/OTP
prompts are auto-answered; passphrases and host key confirmations are not.
feat(ssh): add secret backend support for auth passwords and TOTP secrets
Introduce support for specifying secret backends in SSH auth config, currently supporting only the "text" backend for storing secrets directly. This allows for future extensibility while maintaining backward compatibility by treating values without a backend as "text:<value>".
The changes include new fields in AuthEntry for backends, updated parsing logic in lineHandler, error handling for invalid backends, and normalization for existing configs. A new parseBackendSecret function handles the parsing with validation.
Follow PEP 0394 and use /usr/bin/env python so that the python in the
users venv is respected. Not that the kitty python files are meant to be
executed standalone anyway, but, whatever.
Fixes#6810
Connor Welsh
Kovid Goyal
zhaolei
newwares
NightWatcher
Mike Giroux