These two entries of man ssh-agent describe the SSH authentication socket:

UNIX-domain sockets used to contain the connection to the authentication agent. These sockets should only be readable by the owner. The sockets should get automatically removed when the agent exits.

A UNIX-domain socket is created and the name of this socket is stored in the SSH_AUTH_SOCK environment variable. The socket is made accessible only to the current user. This method is easily abused by root or another instance of the same user.

However, when I echo out the value of $SSH_AUTH_SOCK, I get this value instead: /run/user/1000/keyring-5h6wYS/ssh (with 1000 being the user ID of my current login)

I assume my local system (Ubuntu 14.10) is "hijacking" the default authentication socket and replacing it with the system keyring, but it's not mentioned in the man page, and I can't find more details on the matter.

What is going on behind the scenes, and where can I read up on more details of the process?

  • The Ubuntu manpage says that that path is merely the default. Is there any reason why it should be the default, especially given the actual path is provided by the variable?
    – muru
    Dec 29, 2014 at 20:11
  • @muru I'd argue most distributions and software like using the default path even though it can be changed (e.g. ~/.ssh, ~.gnupg); it typically makes it easier and clearer for everyone. I'd assume if the default directory wasn't used on a major system (such as Ubuntu) things like that are typically mentioned in a man page somewhere.
    – IQAndreas
    Dec 29, 2014 at 20:17
  • @muru I'm looking for that "somewhere" where the information is listed.
    – IQAndreas
    Dec 29, 2014 at 20:18
  • 3
    Are you sure you're using ssh-agent, and not gnome-keyring?
    – derobert
    Dec 29, 2014 at 20:50

1 Answer 1


different tools can act as ssh agents, not just ssh-agent. gpg-agent can also agent for ssh, and gnome-keyring. probably something from KDE also.

As long as SSH_AUTH_SOCK is getting set, you should be good to go.

  • This isn't necessarily true. SSH_AUTH_SOCK can be pointing at a PID file that doesn't exist.
    – cardonator
    May 2, 2018 at 17:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .