How can I find out whether an SSH connection has been established with or without agent forwarding?

I'm trying to do the following:

ssh-add -D (delete all stored keys)
ssh --vvv something
ssh-add (adding key)
ssh --vvv something

and compare output, but I can see only subtle differences.

migrated from stackoverflow.com Aug 16 '11 at 13:00

This question came from our site for professional and enthusiast programmers.

  • 1
    For reference, check out this nice article: blog.joncairns.com/2013/12/understanding-ssh-agent-and-ssh-add. It points you to a nice GitHub repo with a ssh-find-agent script for finding and using existing ssh-agents, very handy! The repo has some examples in the README. You might be able to detect if ssh-agent is enabled like that, along with inspecting the SSH config files, rather than looking at the SSH output. – trusktr Dec 9 '16 at 22:11

When ssh agent forward is enabled on the client (ForwardAgent yes on ~/.ssh/config) and is also enabled on the remote server AllowAgentForwarding yes, when logging to the remote server the environment variable SSH_AUTH_SOCK should exist. Then if you log into another server (you public key must reside on this third server) you should not be prompted for any password.

To clarify:

home$ ssh-add
Enter passphrase ...
Identity added ...
$ ssh  hostA
hostA$ env | grep SSH_AUTH_SOCK
$ ssh hostB
  • 1
    The ssh-add is what did the trick for me. I'd been working for months not knowing about that. Then I switched desktops from Unity to LXDE and agent key forwarding stopped working. – Mark Hudson Sep 26 '12 at 23:04
  • @MarkHudson For some reason when running LXDE you have to run ssh-add every time you open a new console window. So I added that command line to the end of ~/.bash_profile, and now the authentication agent forwarding works every time transparently! – Paul Bernal Feb 20 '14 at 16:28
  • @PaulBernal You shouldn't really need to do that, I imagine you don't have ssh-agent set up correctly. See mah.everybody.org/docs/ssh – Michael Mrozek Feb 20 '14 at 17:37
  • 1
    m2c: the file in "${SSH_AUTH_SOCK}" is a socket, you can test it with if [[ ! -S "${SSH_AUTH_SOCK}" ]]; then echo "warn: no forward agent detected ('${SSH_AUTH_SOCK}' is not a socket)"; fi – Boop Mar 15 '18 at 10:47

Checking environment for SSH_AUTH_SOCK is good for direct ssh connections.

If you use proxies (proxy_command) you might have a connction that looks like:

local -> hostA -> hostB -> hostC -> hostD

If agent forwarding is active on all those hosts, then SSH_AUTH_SOCK will be set and "contains" your ssh key from local on all hosts.

Now suppose agent forwarding is disabled on hostB but enabled on hostC. SSH_AUTH_SOCK will be set on hostD but it will actually be "empty". Of course the agent is forwarded but only from hostC to hostD. The chain is broken.

Now to check if actually the key is available on hostD you can simply call ssh-add. It will exit with code 1 in any case, but if the key is unavailable it will show this on stderr:

Could not open a connection to your authentication agent.

So you can check for the SSH_AUTH_SOCK plus make sure ssh_add has no output.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.