1

I am trying to use SSH Agent Forwarding to configure a deploy script on CentOS. I have a public key copied into the authorized_keys file in ~/.ssh of my deploy user on machine server. I am successfully able to log into the server with the deploy user without a password prompt (and the deploy user's password is locked e.g. passwd -l deploy).

Keep in mind that my .ssh directory only contains the authorized_keys file:

deploy@server $ ls
authorized_keys

Now I need the deploy user to gain access to my git repository from the server. The solution is SSH Agent Forwarding. I should be able to access the repository via the server by performing the following operation on the server:

# List SSH keys that are loaded into the agent
deploy@server $ ssh-add -l
# Make sure they key is loaded if 'ssh-add -l' didn't show anything
deploy@server $ ssh-add
deploy@server $ ssh -A deploy@one-of-my-servers.com 'git ls-remote git@github.com:capistrano/rails3-bootstrap-devise-cancan.git'

The problem is ssh-add fails to load the key:

deploy@server $ exec ssh-agent bash
deploy@server $ ssh-add -l
The agent has no identities.
deploy@server $ ssh-add
deploy@server $ echo $?
=> 1

It prints 1. That means there was a problem. I am a little confused because the documentation states we can use SSH agent forwarding, so I assume we don't need a id_rsa (private key) in deploy's .ssh directory. I just copied the public key from local machine into server's authorized_keys file and then I should be able to use SSH Agent Forwarding to authenticate the git repository. Yet, it seems that ssh-add requires that a private key exist. The documentation never mentioned I had to create a private key on my server.

Where am I going wrong?

Improve this question
3
  • If I cannot find a solution to this, then I am just going to create a private and public key on server and copy the public one to my git account.
    – Donato
    Jun 16, 2015 at 17:47
  • I'm having trouble distinguishing which computer you're running these commands on. Could you edit your question to show in each case whether you're talking about your local machine, or the deploy server?
    – Jander
    Jun 16, 2015 at 18:10
  • @Jander I updated the post.
    – Donato
    Jun 16, 2015 at 18:18

1 Answer 1

Reset to default
3

I think you are wrong to assume that you have to run ssh-add on the server.

If your client machine (that is the machine that has the private key corresponding to the public key in the authorized-keys file on the server) starts the ssh connection, it should enable authentication agent forwarding. You can do so on the commandline by specifying -A as argument to ssh or in general by editing /etc/ssh/ssh_config or ~/.ssh/config (for the user making the connection to server) an specifying:

ForwardAgent yes

For security reasons this is normally set to no.

Running ssh-add on server is not necessary. The reason it exits with 1, is that it doesn't find private keys to add (and forward). If you run ssh-add on the client machine (as the user making the connection) then you will see lines looking like:

 Identity added: /home/your_user/.ssh/id_rsa

Those kind of files are not available in ~/deploy/.ssh on machine server

And you also have to make sure that your git server has your public key installed.

Improve this answer
3
  • If you're going to use ForwardAgent yes in your config file then you should restrict it to specific hosts: Host my.trusted.server \n ForwardAgent yes (where \n is a newline).
    – Jander
    Jun 16, 2015 at 19:10
  • @Jander Is it ok if I put that in my answer (attributed)?
    – Anthon
    Jun 16, 2015 at 19:21
  • Absolutely! I'd rather it be in your answer than my comment, especially since the newline is really awkward in a comment.
    – Jander
    Jun 17, 2015 at 0:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.