Pagent: Show notification of used keys

manu - Fri 16/06/2017 09:59:48 CEST +0200

Hi,

Sometimes I use the KeeAgent plugin for KeePass 2.x
One interesting function of this plugin working as an Agent is the notification message when a key is used.

See this page: http://lechnology.com/software/keeagent/usage/options-and-settings/
And go to section "Show notification whenever key is used by a client program"

Please, can you implement something similar?
I like it when using "Agent forwarding"...

Thank you!

Cyd - Fri 16/06/2017 11:59:01 CEST +0200

This patch http://people.mpi-klsb.mpg.de/~pcernko/pageant.html was integrated into KiTTY.
But it seems to be broken !
I'll check it next week.

manu - Fri 16/06/2017 14:30:45 CEST +0200

Great to hear it!

I hope you can implement the show notification (with full info), and also the option to "request accepting".

Regards.

Cyd - Mon 19/06/2017 08:37:35 CEST +0200

Ok the patch was broken since 2015 !!
I've updated the patch in a new beta build. You can get it here: http://www.9bis.net/kitty/data/beta/kitty.exe

manu - Mon 19/06/2017 15:20:41 CEST +0200

Thank you, Cyd!

However, this version (labeled 0.69.0.1 @ 15/06/2016-20:59:06" doesn't work.
I hope you can fix it!

Futhermore, one question: you will include different options for manual accepting the use of the key?

Regards.

Cyd - Mon 19/06/2017 18:48:35 CEST +0200

What's wrong with you ?
It works on my side.

manu - Mon 19/06/2017 20:54:20 CEST +0200

Hu Cyd,

> What's wrong with you ?

It doesn't show any balloon of notification when the key is used (login with KiTTY).

Here the "About" of the Beta version I'm using:

"Pageant

Custom build

Build platform: 32-bit Windows
Compiler: gcc 5.3.0
Source commit: b1829b81b5c0d12dcc91f6b50b0b4d83c3df6a8e

© 1997-2017 Simon Tatham. All rights reserved."

Are you sure you updated the last beta?

Cyd - Tue 20/06/2017 08:04:42 CEST +0200

Did you set the right comment on your private key ?

manu - Tue 20/06/2017 09:36:05 CEST +0200

Hi Cyd,

> Did you set the right comment on your private key ?

I don't know... I don't set any "comment" in my private keys. I use KeePass (in client mode) and Smartcard certificates. All are listed in the "Kageant Key List" Window. And they are used. However, when the certificate is used, no notification is shown.

Please, can you enable some "Debug" in Kageant to print when the key is used?

Thank you for your good PuTTY version!

Cyd - Tue 20/06/2017 09:59:29 CEST +0200

Read the documentation: http://people.mpi-klsb.mpg.de/~pcernko/pageant.html to see the right comment you need to set.

manu - Tue 20/06/2017 18:56:40 CEST +0200

Hi Cyd,

Ah! OK. Now I see the point!
This patch is for the "ask user confirmation" functionality. I don't see it before.

However, two requests:

1) Can you add a simple INI configuration variable to override globally the need of the "confirmation comment"? I found useful to use it. However, the fist patch in this page makes the request all the times. It's good if the user can enable or disable this functionality. For example, for my smartcard keys I can't modify the name (=comment). Then I can't enable the confirmation request... but disabling the comment I can use them.

In the code this change is quite simple. See the function in the patch:

+static int confirm_key_usage(char* fingerprint, char* comment) {
+ const char* title = "Confirm SSH Key usage";
+ char* message = NULL;
+ int result = IDYES; // successful result is the default
+
+ if ((NULL != strstr(comment, "needs confirm")) ||
+ (NULL != strstr(comment, "need confirm")) ||
+ (NULL != strstr(comment, "confirmation"))) {

You only need to include in the testing of the IF the value of the INI variable to override (or not) the check of the comment.


2) My first request is for showing a notification (balloon) when some key is used. You can see one example in the KeeAgent.
See the image after the section "Show notification whenever key is used by a client program" at
http://lechnology.com/software/keeagent/usage/options-and-settings/

Regarding the code, the source of the KeeAgent is public (even it's C-Sharp, not C). See the function ShowBalloonNotification():
http://github.com/dlech/KeeAgent/blob/64a890427b74735ef70a19a912bd99878ec00ac8/KeeAgent/UI/UIHelper.cs#L41

I feel for you will be easy to show a simple notification message when the event triggers.


Regards.

manu - Tue 20/06/2017 19:07:50 CEST +0200

Hi,

I confirm that including in the Comment of the Key the strings: "needs confirm" or "need confirm" or "confirmation",
then a confirmation window it's used. Great!

However, I really need to override this requirement to force confirm/not confirm.
For example, I suggest to add this configuration INI value:

agentconfirm=yes

Cyd - Thu 22/06/2017 00:08:27 CEST +0200

Ok I've first modify kageant to add an option in kitty.ini configuration file to unable notification on private key usage.

[Agent]
messageonkeyusage=yes

New builds are here:
http://www.9bis.net/kitty/data/beta/kageant.exe
http://www.9bis.net/kitty/data/beta/kitty.exe

manu - Thu 22/06/2017 09:02:38 CEST +0200

Thank you!

The notification is now working with "kageant.exe" and as well with "kitty.exe -runagent". Great!

So my suggestion, if you want to take it into account, it's make "messageonkeyusage" to yes by default. You agree?


Regarding the override of the comment: You will implement it? Example:

[Agent]
askconfirmation=yes|no|auto (yes=always; no=never; auto=based on "comment")


Regards!

Cyd - Thu 22/06/2017 22:04:20 CEST +0200

Done!
Get new builds.

manu - Thu 22/06/2017 23:16:13 CEST +0200

Hi Cyd,

Thank you! It works perfect! Great improvement! ;)

Now, before a new release (if it sounds good to you), perhaps you like to implement the autoload function with this config value:

[Agent]
autoloadagent=yes|no

(see http://www.9bis.net/kitty/?action=forum&id=0810)

manu - Mon 07/08/2017 12:51:20 CEST +0200

Hi,

Some weeks ago I try to use these functions without the PORTABLE versions, that is with the REGISTRY version.
So, where are these paremeters with the REGEDIT tool?

Thank you!

Answer

The forum is actually closed