Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Whenever I use ssh-agent for passwordless logins it doesn't work across different logins and screen sessions, even if they are concurrent.

I suspect it uses some shell variables that don't work across different sessions. Is there some way to configure it or get it to use some kind of variables that can be present on all sessions?

share|improve this question
    
What is the exact command you are using? If it is something like ssh-agent ssh host.example.com then the agent cache will not be available to the session or other logins. Often the agent is child of the window manager so all children of that have access to the agent. –  msw May 7 '13 at 21:51

3 Answers 3

up vote 2 down vote accepted

I use keychain to manage my ssh-agent environment variables, and it deals with making sure only one agent is running at a time. From my .bashrc on appropriate machines:

# is this an interactive shell?
if [[ $- == *i* ]]; then
    # set up ssh key server
    if [[ -x /usr/bin/keychain ]]; then
        eval $(keychain --eval --ignore-missing the <keys I want>)
    fi
fi

It stores the environment variables in ~/.keychain, runs the agent if it isn't found, and returns the new or existing variables to the eval. I set it up a few years ago and haven't touched it. If you have ssh-askpass installed, it will be able to prompt for the password in an X11 environment even when the shell running keychain isn't visible (such as X11 init scripts).

There are other ways to use it, but this works for me across multiple Linux workstations, including logging into a workstation from remote when I'm not logged into X11 there.

share|improve this answer

Yes, ssh uses the SSH_AUTH_SOCK variable to access the agent.

If you start different agents in different sessions they will not share the keys.

Run ssh-agent to see the variables set by this instance.

Read man ssh-agent to find out about possible options. (Especially -a should be helpful in your case.)

The best way to share one agent pretty much depends on your situation. You have to make sure that one and only one agent is running, and that all your sessions have the environment set to use it.

If you are using some desktop environment this usually starts up an ssh-agent and sets the environment to make it available to all processes started inside the desktop session. - If you want to share the a new agent for all your screen sessions you can start screen as ssh-agent screen. - If you want to ssh inside the box and access your agent this is also possible, but you are on your own.

share|improve this answer

You can make a script for everyone's login process which

  1. checks if at least one ssh-agent instance is running (for this user)
  2. selects the instance to be used (the oldest)
  3. checks whether the socket info for this process is available (and correct)
  4. in case of success takes this info in its own environment
  5. and maybe kills the other instances (at least its own if there is one)
ps -o pid,etime,args --no-headers --sort=start_time \
  -p $(pgrep --uid $USER ssh-agent) | 
    awk '{print $1; exit;}'

gives you the PID of the oldest ssh-agent instance. This would be easier with pgrep --uid $USER --oldest ssh-agent but this way you easily get the PIDs of the other instances, too.

You could write $SSH_AUTH_SOCK in a file ~/.ssh/env/$PID (if $SSH_AGENT_PID of the current process equals $PID):

echo "export SSH_AUTH_SOCK=$SSH_AUTH_SOCK" > ~/.ssh/env/$PID

Other sessions could check whether the file exists and is still valid and import it:

bash -c 'test -e ~/.ssh/env/$PID || exit 1;
  . ~/.ssh/env/$PID; test -e $SSH_AUTH_SOCK' && . ~/.ssh/env/$PID
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.