Arch Linux

dkumor

Member

Registered: 2019-08-27

Posts: 1

SSH_AUTH_SOCK not set when forwarding agent

Hi! I have an archlinux desktop, and I connect to it while travelling using ssh both from mac and another arch laptop. Agent forwarding is enabled in sshd config, and I forward the agent with `ssh -A` on command line.

The forwarded agent socket is created at /tmp/ssh-blahblah/agent.blah, however, the corresponding environmental variable, SSH_AUTH_SOCK is not set to the forwarded socket in bash.

That is:

laptop$ ssh -A desktop

desktop$ echo $SSH_AUTH_SOCK
/run/user/1000/gnupg/S.gpg-agent.ssh

desktop$ ls /tmp
ssh-1psF0FXrgrPd

desktop$ git push
permission denied (public key)

desktop$ export SSH_AUTH_SOCK=/tmp/ssh-1psF0FXrgrPd/agent.12453
desktop$ git push
(success)

This happens even with an empty bashrc, and empty bash_profile. I also could not find a reference to SSH_AUTH_SOCK in /etc/profile nor in any file located in /etc/profile.d.

I am at a loss here - I assumed that the environmental variable is supposed to be set by ssh automatically. I also could not find any reference to a similar issue on the wiki. Any suggestions on possible causes?

Debugging Details

ssh -A -v desktop

OpenSSH_8.0p1, OpenSSL 1.1.1c  28 May 2019
debug1: Reading configuration data /home/daniel/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to myhostname [myip] port 22.
debug1: Connection established.
debug1: identity file /home/daniel/.ssh/id_rsa type -1
debug1: identity file /home/daniel/.ssh/id_rsa-cert type -1
debug1: identity file /home/daniel/.ssh/id_dsa type -1
debug1: identity file /home/daniel/.ssh/id_dsa-cert type -1
debug1: identity file /home/daniel/.ssh/id_ecdsa type -1
debug1: identity file /home/daniel/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/daniel/.ssh/id_ed25519 type -1
debug1: identity file /home/daniel/.ssh/id_ed25519-cert type -1
debug1: identity file /home/daniel/.ssh/id_xmss type -1
debug1: identity file /home/daniel/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.0
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.0
debug1: match: OpenSSH_8.0 pat OpenSSH* compat 0x04000000
debug1: Authenticating to myhostname:22 as 'daniel'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:XbOc6UfqGBP8YCrKolot/POINAGBhovBWx0vCAb7cjY
debug1: Host 'myhostname' is known and matches the ECDSA host key.
debug1: Found key in /home/daniel/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: cardno:000608691035 RSA SHA256:Nf+wJG2SV7D5APen+cdKfZ4WvryrtWpD4imk2HvTd4A agent
debug1: Will attempt key: /home/daniel/.ssh/id_rsa 
debug1: Will attempt key: /home/daniel/.ssh/id_dsa 
debug1: Will attempt key: /home/daniel/.ssh/id_ecdsa 
debug1: Will attempt key: /home/daniel/.ssh/id_ed25519 
debug1: Will attempt key: /home/daniel/.ssh/id_xmss 
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: cardno:000608691035 RSA SHA256:Nf+wJG2SV7D5APen+cdKfZ4WvryrtWpD4imk2HvTd4A agent
debug1: Server accepts key: cardno:000608691035 RSA SHA256:Nf+wJG2SV7D5APen+cdKfZ4WvryrtWpD4imk2HvTd4A agent
debug1: Authentication succeeded (publickey).
Authenticated to myhostname ([myip]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Remote: /home/daniel/.ssh/authorized_keys:2: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug1: Remote: /home/daniel/.ssh/authorized_keys:2: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug1: Requesting authentication agent forwarding.
Last login: Wed Aug 28 13:47:07 2019 from 128.10.127.250

journalctl -u sshd

Aug 28 13:48:36 maestro sshd[26911]: Accepted publickey for daniel from 128.210.106.60 port 53027 ssh2: RSA SHA256:Nf+wJG2SV7D5APen+cdKfZ4WvryrtWpD4imk2HvTd4A
Aug 28 13:48:36 maestro sshd[26911]: pam_env(sshd:setcred): pam_putenv: delete non-existent entry; SSH_AGENT_PID
Aug 28 13:48:36 maestro sshd[26911]: pam_unix(sshd:session): session opened for user daniel by (uid=0)
Aug 28 13:48:36 maestro sshd[26911]: pam_env(sshd:session): pam_putenv: delete non-existent entry; SSH_AGENT_PID