{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/2012","repository_url":"https://api.github.com/repos/hashicorp/vault","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/2012/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/2012/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/2012/events","html_url":"https://github.com/hashicorp/vault/issues/2012","id":183362613,"number":2012,"title":"vault ssh - Why are dynamic key secrets written to the client working directory?","user":{"login":"stevehorsfield","id":5338720,"avatar_url":"https://avatars.githubusercontent.com/u/5338720?v=3","gravatar_id":"","url":"https://api.github.com/users/stevehorsfield","html_url":"https://github.com/stevehorsfield","followers_url":"https://api.github.com/users/stevehorsfield/followers","following_url":"https://api.github.com/users/stevehorsfield/following{/other_user}","gists_url":"https://api.github.com/users/stevehorsfield/gists{/gist_id}","starred_url":"https://api.github.com/users/stevehorsfield/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevehorsfield/subscriptions","organizations_url":"https://api.github.com/users/stevehorsfield/orgs","repos_url":"https://api.github.com/users/stevehorsfield/repos","events_url":"https://api.github.com/users/stevehorsfield/events{/privacy}","received_events_url":"https://api.github.com/users/stevehorsfield/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-10-17T09:08:25Z","updated_at":"2016-10-18T08:17:19Z","closed_at":null,"body":"See https://github.com/hashicorp/vault/blob/master/command/ssh.go#L165.\r\n\r\nThis seems to be an unnecessary step. Could you explain the thinking, and whether you believe this should be hardened? It's also not desirable from a purely user experience perspective, as it leaves files hanging around in client folders."},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/254438656","html_url":"https://github.com/hashicorp/vault/issues/2012#issuecomment-254438656","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/2012","id":254438656,"user":{"login":"stevehorsfield","id":5338720,"avatar_url":"https://avatars.githubusercontent.com/u/5338720?v=3","gravatar_id":"","url":"https://api.github.com/users/stevehorsfield","html_url":"https://github.com/stevehorsfield","followers_url":"https://api.github.com/users/stevehorsfield/followers","following_url":"https://api.github.com/users/stevehorsfield/following{/other_user}","gists_url":"https://api.github.com/users/stevehorsfield/gists{/gist_id}","starred_url":"https://api.github.com/users/stevehorsfield/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevehorsfield/subscriptions","organizations_url":"https://api.github.com/users/stevehorsfield/orgs","repos_url":"https://api.github.com/users/stevehorsfield/repos","events_url":"https://api.github.com/users/stevehorsfield/events{/privacy}","received_events_url":"https://api.github.com/users/stevehorsfield/received_events","type":"User","site_admin":false},"created_at":"2016-10-18T08:17:19Z","updated_at":"2016-10-18T08:17:19Z","body":"My point is that that is a risk. I have these files hanging around on my machine. The file is only deleted once the ssh session is terminated cleanly (from a client perspective) which often isn't the case. In any case, the file remains on disk in the interim.\r\n\r\nLooking at the `ssh` command, it doesn't like reading the identity file directly from a named pipe. So, I would suggest that using a separate `ssh-agent` process:\r\n\r\n* Spawn a new `ssh-agent` process\r\n* Use `ssh-add` to add the identity to the agent from `stdin`\r\n* Invoke `ssh`\r\n\r\n```\r\n$ /bin/cat ~/.ssh/id_rsa | ssh-add -\r\nIdentity added: (stdin) ((stdin))\r\n$ ssh-add -l\r\n2048 SHA256:oSjhwzdswo47uBKM/LC22aElaVaMZ/3HzRRehFRcJjw (stdin) (RSA)\r\n```"}}
{"actor":{"display_login":"stevehorsfield"}}