openssh-portable icon indicating copy to clipboard operation
openssh-portable copied to clipboard

ssh-sk-helper: observe SSH_SK_HELPER_TIMEOUT

Open martelletto opened this issue 2 years ago • 0 comments

Interactions with FIDO authenticators may block due to user interaction (touch). Most FIDO2 authenticators (e.g. Yubikeys) observe a 30-second timeout, but that's not guaranteed by the FIDO2 spec. On U2F-only devices, there is no timeout and the operation may block indefinitely.

This commit allows a timeout to be passed to ssh-sk-helper through a SSH_SK_HELPER_TIMEOUT environment variable, passes the timeout to the security key provider (note the SSH_SK_VERSION_MAJOR bump), and calls fido_dev_set_timeout() in the built-in security key provider to observe the specified timeout.

martelletto avatar Mar 12 '23 18:03 martelletto