openssh-portable
openssh-portable copied to clipboard
ssh-sk-helper: observe SSH_SK_HELPER_TIMEOUT
Interactions with FIDO authenticators may block due to user interaction (touch). Most FIDO2 authenticators (e.g. Yubikeys) observe a 30-second timeout, but that's not guaranteed by the FIDO2 spec. On U2F-only devices, there is no timeout and the operation may block indefinitely.
This commit allows a timeout to be passed to ssh-sk-helper through a SSH_SK_HELPER_TIMEOUT environment variable, passes the timeout to the security key provider (note the SSH_SK_VERSION_MAJOR bump), and calls fido_dev_set_timeout() in the built-in security key provider to observe the specified timeout.