echo $? prints 1 after running ssh-add

Question

I am trying to use SSH Agent Forwarding to configure a deploy script on CentOS. I have a public key copied into the authorized_keys file in ~/.ssh of my deploy user on machine server. I am successfully able to log into the server with the deploy user without a password prompt (and the deploy user's password is locked e.g. passwd -l deploy).

Keep in mind that my .ssh directory only contains the authorized_keys file:

deploy@server $ ls
authorized_keys

Now I need the deploy user to gain access to my git repository from the server. The solution is SSH Agent Forwarding. I should be able to access the repository via the server by performing the following operation on the server:

# List SSH keys that are loaded into the agent
deploy@server $ ssh-add -l
# Make sure they key is loaded if 'ssh-add -l' didn't show anything
deploy@server $ ssh-add
deploy@server $ ssh -A deploy@one-of-my-servers.com 'git ls-remote git@github.com:capistrano/rails3-bootstrap-devise-cancan.git'

The problem is ssh-add fails to load the key:

deploy@server $ exec ssh-agent bash
deploy@server $ ssh-add -l
The agent has no identities.
deploy@server $ ssh-add
deploy@server $ echo $?
=> 1

It prints 1. That means there was a problem. I am a little confused because the documentation states we can use SSH agent forwarding, so I assume we don't need a id_rsa (private key) in deploy's .ssh directory. I just copied the public key from local machine into server's authorized_keys file and then I should be able to use SSH Agent Forwarding to authenticate the git repository. Yet, it seems that ssh-add requires that a private key exist. The documentation never mentioned I had to create a private key on my server.

Where am I going wrong?

Answer 1

I think you are wrong to assume that you have to run ssh-add on the server.

If your client machine (that is the machine that has the private key corresponding to the public key in the authorized-keys file on the server) starts the ssh connection, it should enable authentication agent forwarding. You can do so on the commandline by specifying -A as argument to ssh or in general by editing /etc/ssh/ssh_config or ~/.ssh/config (for the user making the connection to server) an specifying:

ForwardAgent yes

For security reasons this is normally set to no.

Running ssh-add on server is not necessary. The reason it exits with 1, is that it doesn't find private keys to add (and forward). If you run ssh-add on the client machine (as the user making the connection) then you will see lines looking like:

 Identity added: /home/your_user/.ssh/id_rsa

Those kind of files are not available in ~/deploy/.ssh on machine server

And you also have to make sure that your git server has your public key installed.