1

When I log in to my local Ubuntu 14 instance from Windows (I use SecureCRT as a SSH client) using my RSA key, the key is available for forwarding for further SSH sessions (it is listed with ssh-add -l). However, I can't add more identities to the default agent:

# ssh-add -l
2047 29:c7:24:ca:ee:21:c8:1c:8e:31:7b:60:d9:45:45:df "rsa-vwal-20160112" (RSA)
# ps aux | grep ssh-agent
ville      3102  0.0  0.1  12968  2280 pts/3    S+   02:13   0:00 grep --color=auto ssh-agent
# env | grep SSH
SSH_CLIENT=192.168.50.101 30920 22
SSH_CONNECTION=192.168.50.101 30920 192.168.220.20 22
SSH_TTY=/dev/pts/3
SSH_AUTH_SOCK=/tmp/ssh-UVKqhSow2l/agent.2679
# ssh-add /home/ville/.ssh/keys/gitkey/gitkey
Enter passphrase for /home/ville/.ssh/keys/gitkey/gitkey: 
SSH_AGENT_FAILURE
Could not add identity: /home/ville/.ssh/keys/gitkey/gitkey
#

I assume this is because there is no real ssh-agent process; apparently the initial agent is provided by sshd(?)

Now if I start a new agent and apply the environment variables it generates so that the SSH_AUTH_SOCK changes, I can add identities to the agent...

# ssh-agent
SSH_AUTH_SOCK=/tmp/ssh-G8dg8bePFC8K/agent.3115; export SSH_AUTH_SOCK;
SSH_AGENT_PID=3116; export SSH_AGENT_PID;
echo Agent pid 3116;
# SSH_AUTH_SOCK=/tmp/ssh-G8dg8bePFC8K/agent.3115; export SSH_AUTH_SOCK;
# SSH_AGENT_PID=3116; export SSH_AGENT_PID;
# ps aux | grep ssh-agent                  
ville      3116  0.0  0.0  10628   320 ?        Ss   02:16   0:00 ssh-agent
ville      3128  0.0  0.1  12968  2120 pts/3    S+   02:20   0:00 grep --color=auto ssh-agent
# ssh-add -l
The agent has no identities.
# ssh-add /home/ville/.ssh/keys/gitkey/gitkey
Enter passphrase for /home/ville/.ssh/keys/gitkey/gitkey: 
Identity added: /home/ville/.ssh/keys/gitkey/gitkey (/home/ville/.ssh/keys/gitkey/gitkey)
# ssh-add -l                                 
2048 05:9c:bc:b5:cd:e4:4e:a1:53:60:57:b4:39:e4:18:d5 /home/ville/.ssh/keys/gitkey/gitkey (RSA)
# 

... but obviously the initial key is no longer available because the agent is now different.

My question is: Is it possible to retain the login key in the agent, AND be able to add more identities to it with ssh-add? Can I, for example, make the initial agent accept additional identities to it, or perhaps somehow duplicate the login key into the explicitly instantiated agent?

2

It is not a problem of ssh-agent, but of your Windows client (providing ssh-agent interface). It looks like it does not implement interface to add another key from the socket. This should not be a problem with normal ssh-agent.

Only possible solution today, I know about is to copy the key to your local host.

There is open upstream openssh bug (client changes) requesting similar functionality (support for the list of agents), which should solve your issue.

  • 1
    Ah, I see.. the reason for why I'm not seeing the ssh-agent process at first is that the Ubuntu SSH_AUTH_SOCK is providing a socket to the agent in SecureCRT. Thanks for the explanation; I'm opening a feature request on SecureCRT side based on this answer. – Ville May 2 '16 at 16:15
  • For those interested, the associated SecureCRT feature request is now open here ->> fetch.link/1Z3sBkC – Ville May 2 '16 at 16:29
  • This is another related SecureCRT feature request ->> fetch.link/2jxALr3 – Ville Jan 10 '17 at 6:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.