4

These two entries of man ssh-agent describe the SSH authentication socket:

$TMPDIR/ssh-XXXXXXXXXX/agent.<ppid>
UNIX-domain sockets used to contain the connection to the authentication agent. These sockets should only be readable by the owner. The sockets should get automatically removed when the agent exits.

A UNIX-domain socket is created and the name of this socket is stored in the SSH_AUTH_SOCK environment variable. The socket is made accessible only to the current user. This method is easily abused by root or another instance of the same user.

However, when I echo out the value of $SSH_AUTH_SOCK, I get this value instead: /run/user/1000/keyring-5h6wYS/ssh (with 1000 being the user ID of my current login)

I assume my local system (Ubuntu 14.10) is "hijacking" the default authentication socket and replacing it with the system keyring, but it's not mentioned in the man page, and I can't find more details on the matter.

What is going on behind the scenes, and where can I read up on more details of the process?

  • The Ubuntu manpage says that that path is merely the default. Is there any reason why it should be the default, especially given the actual path is provided by the variable? – muru Dec 29 '14 at 20:11
  • @muru I'd argue most distributions and software like using the default path even though it can be changed (e.g. ~/.ssh, ~.gnupg); it typically makes it easier and clearer for everyone. I'd assume if the default directory wasn't used on a major system (such as Ubuntu) things like that are typically mentioned in a man page somewhere. – IQAndreas Dec 29 '14 at 20:17
  • @muru I'm looking for that "somewhere" where the information is listed. – IQAndreas Dec 29 '14 at 20:18
  • 3
    Are you sure you're using ssh-agent, and not gnome-keyring? – derobert Dec 29 '14 at 20:50
0

different tools can act as ssh agents, not just ssh-agent. gpg-agent can also agent for ssh, and gnome-keyring. probably something from KDE also.

As long as SSH_AUTH_SOCK is getting set, you should be good to go.

  • This isn't necessarily true. SSH_AUTH_SOCK can be pointing at a PID file that doesn't exist. – cardonator May 2 '18 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.