5

I use oh-my-zsh's ssh-agent plugin to have a static symlink to my current SSH_AUTH_SOCK created. When connecting through SSH with agent forwarding enabled the file /tmp/ssh-agent-$USER-screen is symlinked to /tmp/ssh-<whatever>/agent.<some numbers>:

agross@router ~
$ ls -la /tmp/ssh-agent*
lrwxrwxrwx. 1 agross agross 30 Jan  7 21:35 /tmp/ssh-agent-agross-screen -> /tmp/ssh-uoof1WiDSw/agent.7745

agross@router ~
$ ls -la /tmp/ssh-uoof1WiDSw/
srwxr-xr-x. 1 agross agross  0 Jan  7 21:35 agent.7745

I tested the symlink successfully with ssh-add -l:

agross@router ~
$ ssh-add -l
2048 15:5a:dd... /home/agross/.ssh/id_rsa (RSA)

agross@router ~
$ echo $SSH_AUTH_SOCK
/tmp/ssh-agent-agross-screen

As soon as I su I cannot access the symlink anymore, but the symlink target works fine.

[root@router ~]# socat -v - UNIX-CONNECT:/tmp/ssh-agent-agross-screen
2016/01/07 21:51:04 socat[16054] E connect(3, AF=1 "/tmp/ssh-agent-agross-screen", 30): Permission denied

[root@router ~]# socat - UNIX-CONNECT:/tmp/ssh-uoof1WiDSw/agent.7745
<empty line is printed so I guess I'm connected>

[root@router ~]# echo $SSH_AUTH_SOCK
/tmp/ssh-agent-agross-screen

[root@router ~]# ssh-add -l
Could not open a connection to your authentication agent.

[root@router ~]# SSH_AUTH_SOCK=/tmp/ssh-uoof1WiDSw/agent.7745 ssh-add -l
2048 15:5a:dd... /home/agross/.ssh/id_rsa (RSA)

I researched that the permissions on the symlink are not evaluated, rather the permissions on the symlink target are relevant to decide weather a user (root even?) is able to access a file. And accessing the symlink target works flawlessly.

What could be the problem here?

I'm running CentOS 7, in case it matters. Thank you!


Updated afters questions:

SSH_AUTH_SOCK is exported

I don't think it matters w.r.t. not being able to connect to the symlink with socat, though.

[root@router ~]# export | grep SSH
declare -x SSH_AUTH_SOCK="/tmp/ssh-agent-agross-screen"

SELinux

Seems like that doesn't matter as well.

[root@router ~]# getenforce
Enforcing
[root@router ~]# setenforce 0
[root@router ~]# socat - UNIX-CONNECT:/tmp/ssh-agent-agross-screen
2016/01/08 09:54:09 socat[21673] E connect(3, AF=1 "/tmp/ssh-agent-agross-screen", 30): Permission denied
[root@router ~]# setenforce 1
[root@router ~]# socat - UNIX-CONNECT:/tmp/ssh-agent-agross-screen
2016/01/08 09:54:45 socat[21675] E connect(3, AF=1 "/tmp/ssh-agent-agross-screen", 30): Permission denied

Symlink in ~ vs symlink in /tmp

Thanks to @masm for the pointer. A symlink in my home directory works, whereas the symlink in /tmp doesn't.

[root@router ~]# ls -lZ /home/agross
lrwxrwxrwx. agross agross unconfined_u:object_r:user_home_t:s0 foo -> /tmp/ssh-QlnhyjUQDp/agent.15895

[root@router ~]# socat -v - UNIX-CONNECT:/home/agross/foo
<empty line>

[root@router ~]# ls -lZ /tmp
lrwxrwxrwx. agross agross unconfined_u:object_r:user_tmp_t:s0 ssh-agent-agross-screen -> /tmp/ssh-QlnhyjUQDp/agent.15895

[root@router ~]# socat -v - UNIX-CONNECT:/tmp/ssh-agent-agross-screen
2016/01/08 18:14:48 socat[15989] E connect(3, AF=1 "/tmp/ssh-agent-agross-screen", 30): Permission denied
5
  • Is the SSH_AUTH_SOCK environment variable exported into environment of the ssh-add you are spawning from the shell?
    – peterph
    Commented Jan 7, 2016 at 22:33
  • CentOS is using SELinux. Even if you are root, applications might be confined. Can you check the same use case with SELinux in permissive mode (setenforce 0)?
    – Jakuje
    Commented Jan 7, 2016 at 23:14
  • @peterph Thanks for your question! Yes, SSH_AUTH_SOCK is exported. Commented Jan 8, 2016 at 8:58
  • @Jakuje Thanks for your question! SELinux doesn't seem to be relevant here. Commented Jan 8, 2016 at 8:58
  • I reproduced the error with only socat (without ssh). If you can use otherwhere (e.g. your home) instead of /tmp, it may work. I don't know the reason.
    – masm
    Commented Jan 8, 2016 at 14:18

1 Answer 1

2

fs.protected_symlinks=1 was the culprit:

[root@router ~]# sysctl fs.protected_symlinks
fs.protected_symlinks = 1
[root@router ~]# sysctl -w fs.protected_symlinks=0
fs.protected_symlinks = 0

[root@router ~]# socat -v - UNIX-CONNECT:/tmp/ssh-agent-agross-screen

[root@router ~]# sysctl -w fs.protected_symlinks=1
fs.protected_symlinks = 1

[root@router ~]# socat -v - UNIX-CONNECT:/tmp/ssh-agent-agross-screen
2016/01/09 01:46:21 socat[20591] E connect(3, AF=1 "/tmp/ssh-agent-agross-screen", 30): Permission denied

Kudos: https://askubuntu.com/questions/599719/how-can-i-set-a-symlink-from-tmp-mysql-sock

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .