No clear indication which SSH agent on Windows is not running

[komatom]

Overview

This bug is about using SSH Agent integration, if you for example set to use Pageant and OpenSSH agent, if let's say openssh agent is not started or not available, agent integration doesn't work for Pageant too with error that agent is not available. So in other words if you enable both agents, but one is not working, the feature doesn't work for the second too.

Steps to Reproduce

1. Make sure you have Pageant working and OpenSSH agent unavailable on windows 10/11
2. Check "Enable SSH agent", "Use Pageant", "Use OpenSSH"
3. Try to unlock DB to see if it imports saved keys to any of the agents

Expected Behavior

When you have both agents checked and one is not working, it should work for the one agent you have in running state.

Actual Behavior

If you have 2 agents checked, but OpenSSH agent is not running or not installed, it doesn't work for Pageant too

KeePassXC - Version 2.7.0-beta1
Build Type: PreRelease
Revision: 046e508

Operating System: Windows 11

[hifi]

I explicitly required that both agents need to be running because the intention of the option is to add to both agents.

[komatom]

Maybe options dialog should check if OpenSSH agent is running in the moment, by default that agent is off in windows, otherwise it should be grayed out to clear confusion afterwards.. We can add in brackets "()" that the specific agent is not running when the option is grayed out, to inform the user to enable ssh agent feature in Windows features.

[hifi]

Graying out would also make it impossible to select. I think just adding the brackets would be okay but it requires some refactoring.

I don't think this is a release blocker right now as it works as intended but the UX is a bit flaky so I'll set the milestone to v2.7.1.

Thanks.

[bhujagendra-ishaya]

I came across this after updating to 2.7.0. I assume, it's a new feature and therefore by default both agents are enabled (in fact, the options page was only set to "Enable SSH Agent integration" with both agents unticked.

In my understanding, when no specific agent is selected, no agent should be used. Only when an agent is actually activated, that one should be used.

As such, a simple warning message at startup would help in the case of "Enable SSH Agent integration" enabled but both agents disabled, saying, that no specific SSH agent is enabled. This would help during updates.

So in addition to @komatom's suggestion to indicate which agent is not working, I would suggest the following behavior:

Enable SSH Agent integration	Use Pageant	Use OpenSSH	Pageant	OpenSSH	Message
🔲	(disabled)	(disabled)			[none]
✅	🔲	🔲			SSH agent integration is active but no agent selected in the options.
✅	✅	🔲	running		[none]
✅	✅	🔲	n/a		SSH agent "Pageant" is selected but cannot be detected.
✅	🔲	✅		running	[none]
✅	🔲	✅		n/a	SSH agent "OpenSSH" is selected but cannot be detected.
✅	✅	✅	running	running	[none]
✅	✅	✅	running	n/a	SSH agent "OpenSSH" is selected but cannot be detected.
✅	✅	✅	n/a	running	SSH agent "Pageant" is selected but cannot be detected.
✅	✅	✅	n/a	n/a	All SSH agents are selected but none caould be detected.

[hifi]

I missed the fact no agents are enabled by default after the change and it was completely unintentional. I don't use Windows myself so it's on me for not testing the change thoroughly.

I'm leaning towards changing the checkboxes to radio buttons where the default is pageant like it has been before and have a third option for both being enabled at the same time. It makes no sense to have a state that doesn't work at all and enforcing the checkboxes to work like radio buttons is bad UX.

I'll set up a build environment on Windows and get this fixed.

@bhujagendra-ishaya Great table, by the way! I'll consider if the messages could be updated.

[komatom]

Radio buttons might do it better, and skipping "Enable SSH agent Integration" like:

• Disabled ( SSH integration completely OFF )
• Enable Pageant agent
• Enable OpenSSH agent
• Enable All supported and available/installed agents

Very rough idea, it might even work with select box.

[hifi]

Windows is the only platform that has more than one way to talk with an agent and the enable integration checkbox is shared across platforms so I'd keep it as is because it's consistent.

[bhujagendra-ishaya]

I think having a checkbox to enable integration is good. It is also consistent with the other tabs, e.g. "Browser Integration".

I would even suggest to move the message block underneath the "Enable SSH Agent integration", rather than above it. It could even have a label, e.g. "Status:". Doing so also prevents moving the enable checkbox up and down.

Then, on Windows only, either have radio buttons as suggested by @komatom (without the disabled option), or keep them as checkboxes and employ the logic from my table above (thanks for the compliment), which I have adapted for the messages shown in the status box:

	Enable	Pageant1	OpenSSH1	Pageant1	OpenSSH2	Message	3
all	🔲	⛔️1	⛔️1			Disabled
win	✅	🔲	🔲			Please select an agent below!
win	✅	✅	🔲	running		SSH Agent connection is working!
win	✅	✅	🔲	n/a		"Pageant" agent cannot be detected.	✅
win	✅	🔲	✅		running	SSH Agent connection is working!
win	✅	🔲	✅		n/a	"OpenSSH" agent cannot be detected.	✅
all	✅	✅1	✅1	running1	running	SSH Agent connection is working!
win	✅	✅	✅	running	n/a	"OpenSSH" agent cannot be detected.	✅
win	✅	✅	✅	n/a	running	"Pageant" agent cannot be detected.	✅
all	✅	✅1	✅1	n/a1	n/a	SSH Agent connection is working!

Footnotes

1. Windows only ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹

2. OpenSSH or socket on non-Windows ↩

3. Startup warning message ↩

[martin-rueegg]

Hey @hifi

I know it's a while ago, but I realized that this has been implemented and found it's way into production.

Thank you so much for this!

All the best,
Martin.