https://bugs.kde.org/show_bug.cgi?id=523305
Bug ID: 523305
Summary: Plasma/wayland session login deadlocks/freezes:
neon_ksshaskpass.sh runs ssh-add and ksshaskpass
prompts before compositor starts
Classification: KDE Neon
Product: neon
Version First unspecified
Reported In:
Platform: Neon
OS: Linux
Status: REPORTED
Severity: crash
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected], [email protected],
[email protected]
Target Milestone: ---
DESCRIPTION
/etc/xdg/plasma-workspace/env/neon_ksshaskpass.sh runs ssh-add with ksshaskpass
at session login, before any desktop has rendered.
I've been using a systemd user service for ssh-agent for my ssh-keys, which as
best I can tell is standard best-practice.
Under wayland, when you have an ssh-agent running (e.g. with systemd user
service) and a password protected default ssh-key, I think what ends up
happening is ksshaskpass triggers an attempt to show a GUI prompt for the
default ssh-key password, _before_ the compositor exists. So the session
deadlocks at startup, completely freezes, can't get into the desktop, requiring
a reboot.
When doing the same under X11 instead of Wayland, the ksshaskpass GUI prompt
displays in front of a black screen, preventing any desktop stuff from loading
until you complete or dismiss it, but you are able to log in.
This changed sometime around my 6.7 upgrade. I waited till 6.7.2 to upgrade and
just started seeing this.
disabling that file with sudo dpkg-divert fixes the issue.
STEPS TO REPRODUCE
I was able to do this with a fresh VM using neon-user-desktop-20260716-0522.iso
and brand new user.
1. make an ssh key with a passphrase e.g. ssh-keygen -t rsa -b 4096 -f
~/.ssh/id_rsa
2. (possibly not needed) create ~/.config/environment.d/ssh_auth_socket.conf
with the contents:
SSH_AUTH_SOCK="${XDG_RUNTIME_DIR}/ssh-agent.socket"
3. create the systemd ssh-agent service at
~/.config/systemd/user/ssh-agent.service:
[Unit]
Description=SSH key agent
[Service]
Type=simple
Environment=SSH_AUTH_SOCK=%t/ssh-agent.socket
ExecStart=/usr/bin/ssh-agent -D -a $SSH_AUTH_SOCK
[Install]
WantedBy=default.target
4. enable that service: systemctl --user enable ssh-agent.service
5. reboot
6. attempt to login either under X11 or Wayland, see results
7. disable the script to be able to login under wayland, sudo dpkg-divert
--local --rename --add /etc/xdg/plasma-workspace/env/neon_ksshaskpass.sh
OBSERVED RESULT
1. under X11, you will be able to login, but you'll see the ksshaskpass prompt
for password before any other desktop decoration renders. only after
entering/dismissing the popup will your desktop load.
2. under Wayland, the system should completely freeze, no mouse movement, no
response, ctrl-alt-f1/2/3 may not even work. Presumably it's trying to show
that same ksshaskpass prompt, but this breaks completely under Wayland.
EXPECTED RESULT
If i'm running ssh-agent with a password protected ssh-key, I should be able to
login to plasma-wayland.
While I'm at it, i should be able to disable the ksshaskpass entirely so the
prompt happens in my shell, not via a gui popup.
SOFTWARE/OS VERSIONS
Operating System: KDE neon User Edition
KDE Plasma Version: 6.7.3
KDE Frameworks Version: 6.28.0
Qt Version: 6.11.1
Kernel Version: 7.0.0-28-generic (64-bit)
Graphics Platform: Wayland
Processors: 8 × 11th Gen Intel® Core™ i7-1185G7 @ 3.00GHz
Memory: 16 GiB of RAM (15.3 GiB usable)
Graphics Processor: Intel® Iris® Xe Graphics
ADDITIONAL INFORMATION
contents of neon_ksshaskpass.sh is currently:
#!/bin/sh
# SPDX-License-Identifier: GPL-3.0-only OR LicenseRef-KDE-Accepted-GPL
# SPDX-FileCopyrightText: 2025 Carlos De Maine <[email protected]>
# export SSH_ASKPASS to be ksshaskpass
export SSH_ASKPASS='/usr/bin/ksshaskpass'
export SSH_ASKPASS_REQUIRE='prefer'
ssh-add < /dev/null
--
You are receiving this mail because:
You are watching all bug changes.
