Index | Thread | Search

From:
"Theo de Raadt" <deraadt@openbsd.org>
Subject:
Re: [new/wip] wayland/waypipe for ssh -X-like forwarding
To:
Landry Breuil <landry@openbsd.org>
Cc:
Matthieu Herrb <matthieu@openbsd.org>, ports@openbsd.org
Date:
Wed, 12 Nov 2025 09:14:00 -0700

Download raw body.

Thread
  • Matthieu Herrb:

    [new/wip] wayland/waypipe for ssh -X-like forwarding

  • This feels like it is getting worse and worse.
    
    I don't want to copy any such environment variables over my ssh.  I
    don't want my uid from one machine, exported to another machine (where
    it is incorrect as matthieu points out).
    
    You can recommend this all you want, but may people won't do this.
    So some applications will work with the environment variable, and
    others won't, which has been explained to me is a very shitty experience
    (shittier than not doing the environment variable at all, isn't it?)
    
    Landry Breuil <landry@openbsd.org> wrote:
    
    > Le Wed, Nov 12, 2025 at 04:03:16PM +0100, Landry Breuil a écrit :
    > > Le Wed, Nov 12, 2025 at 07:39:01AM -0700, Theo de Raadt a écrit :
    > > > > - add XDG_RUNTIME_DIR=/tmp/run/user/<uid> to ~/.ssh/environment
    > > > 
    > > > That is so incredibly user hostile.  First of all, it is a uid,
    > > > and secondly this now applies to all non-interactive sessions also.
    > > > Just plain yuck.
    > > 
    > > then i guess the alternative would be to:
    > > - advertise 'waypipe ssh target env XDG_RUNTIME_DIR=xxx command'
    > > - add a section in ~/.ssh/config with SendEnv XDG_RUNTIME_DIR for the
    > >   given targets ?
    > 
    > i've given this a try, and waypipe works transparently with:
    > 
    > - in .ssh/config
    > 
    > Host localhost
    >         SendEnv XDG_RUNTIME_DIR
    > 
    > - in /etc/ssh/sshd_config:
    > 
    > PermitUserEnvironment XDG_RUNTIME_DIR
    > AcceptEnv XDG_RUNTIME_DIR
    > 
    > (of course those two could be in a Match block)
    > 
    
    
  • Matthieu Herrb:

    [new/wip] wayland/waypipe for ssh -X-like forwarding