3

I'm on Ubuntu 14.04. For a few weeks now a small window keeps popping up randomly, grabbing my keyboard and asking me to enter the passphrase for my ssh key. The Window's title says "OpenSSH", and it states the path of the private key file it wants to unlock.

Of course, I don't do it, because I don't know where this request is coming from. Sometimes, after I hit cancel, a warning window pops up, saying that something might be eavesdropping on my session, because the keyboard could not be grabbed.

This sounds very suspicious to me. I can't remember doing anything with ssh that might cause this behavior. How would I go about finding out where these ssh key requests are coming from and how to stop them?

toster
  • 131
  • 1
    Are you sure it's ssh passphrase or gnome keyring passphrase? – cuonglm Jul 28 '14 at 08:55
  • The window specifically states it wants to unlock the ssh key in /home/toster/.ssh/id_rsa. The window title is "OpenSSH". Perhaps gnome-keyring is requesting it though? – toster Jul 28 '14 at 11:43
  • Do you have ssh-askpass installed? (see: http://unix.stackexchange.com/q/83986/50594 ) – Twinkles Jul 28 '14 at 12:07
  • I have ssh-askpass-gnome, which I assume is essentially the same – toster Jul 28 '14 at 13:41
  • When it happens, switch to a terminal and use ps(1) to look for any SSH processes. Use PPID's or pstree(1) to climb up the process hierarchy and find out what's spawning it. Sounds sketchy as hell. Let us know what you find. – ruief Sep 09 '14 at 17:07

2 Answers2

1

I have (hopefully the right word is had now) the same issue, and I think a cron job was responsible for the dialog.

I run crontab -l and found that I had a cron job set at the same time the dialog appeaed. Since I didn't needed the cron job I did crontab -r. I haven't seen the dialog since, but it hasn't been too long.

Have you solved your issue? If so, how?

Community
  • 1
spelufo
  • 477
1

I had the same issue on Ubuntu 16.04. The dialog went away after I did this:

  • removed ssh-askpass (sudo apt remove ssh-askpass); and
  • commented out a crontab that uses ssh(1) (crontab -e).

Either one of this is sufficient to remove the dialog.

When the host that my cronjob tried to connect to (usually through key authentication without password) was in maintenance, the x11-ssh-askpass dialogs started to appear.

Om my opinion, even though x11-ssh-askpass is a legitimate program, it is best not to let X11 programs to interfere with authentication and encryption.

Marco van Hulten
  • 11