Arch Linux

Omar007

Member

Registered: 2015-04-09

Posts: 368

XDG_RUNTIME_DIR not (yet) set (SSH agent by systemd with socket there)

I was setting up my SSH agent to run through a systemd user service but was having trouble getting the SSH_AUTH_SOCK to reflect the correct path.

For reference, this was the setup I was going for.
/etc/systemd/user/ssh-agent.service

[Unit]
Description=SSH agent

[Service]
Type=simple
Environment=SSH_AUTH_SOCK=%t/ssh-agent.sock
ExecStart=/usr/bin/ssh-agent -D -a ${SSH_AUTH_SOCK}

[Install]
WantedBy=default.target

/etc/security/pam_env.conf

SSH_AUTH_SOCK	DEFAULT="${XDG_RUNTIME_DIR}/ssh-agent.sock"	OVERRIDE="${SSH_AUTH_SOCK}"

(allowing override in case the service isn't used)

The service runs fine and the socket is created in the expected location. However, the value of SSH_AUTH_SOCK is just '/ssh-agent.sock' and is missing the value of XDG_RUNTIME_DIR.

Looking through the Arch Wiki I found that XDG_RUNTIME_DIR is supposed to be set by pam_systemd and checking the value manually with `printenv XDG_RUNTIME_DIR` shows the correct value (in my case '/run/user/1000').
This lead me to initially believe that pam_env.conf might be run earlier and thus the value is not available yet.
Setting XDG_RUNTIME_DIR in pam_env.conf to default to /run/user/${UID} is not an option though as ${UID} is not available at that point in time either.

I later found on the Arch wiki a very similar way of setting up the SSH agent (https://wiki.archlinux.org/index.php/SS … stemd_user), with the main difference being the PAM file used; the user local ~/.pam_environment is used instead of the system pam_env.conf.
Since it explicitly mentioned that file I assumed that maybe it is loaded later on; after XDG_RUNTIME_DIR is set. I moved the SSH_AUTH_SOCK to that file instead but it is showing the exact same behaviour as before with pam_env.conf and the value is just '/ssh-agent.sock' and yet again missing the value of XDG_RUNTIME_DIR.

Am I missing something here or is this not supposed to work? (anymore? It being on the wiki as well gives the impression it should work)

EDIT: Oh and fyi, I'm not using Gnome and there is no gnome-keyring process running with --component=ssh.
The wiki mentions this possibly conflicting but that is not relevant in this case.

EDIT2: I've gone through the different login related files in /etc/pam.d and this suggests that either file should work fine and that XDG_RUNTIME_DIR should be available at that point in time, yet somehow it isn't...
./login includes ./system-local-login includes ./system-login which specifies:

...
-session   optional   pam_systemd.so
session    required   pam_env.so

Last edited by Omar007 (2019-06-03 14:35:35)