Setting up PAM sudo authentication, using ssh-agent, on 14.04.1-Ubuntu server LTS.

I'm still unable to successfully authenticate sudo, via the ssh-agent, using PAM.

Here are my relevant /var/log/auth.log entries...

Jun 17 11:31:16 host sudo[21318]: pam_ssh_agent_auth: Beginning pam_ssh_agent_auth for user userName
Jun 17 11:31:16 host sudo[21318]: pam_ssh_agent_auth: Attempting authentication: `userName' as `userName' using /etc/security/authorized_keys
Jun 17 11:31:16 host sudo[21318]: pam_ssh_agent_auth: Contacted ssh-agent of user userName (1000)
Jun 17 11:31:16 host sudo[21318]: pam_ssh_agent_auth: Failed Authentication: `userName' as `userName' using /etc/security/authorized_keys

As you can see, it successfully contacts the ssh-agent, but then authentication fails. PAM falls back to the next authentication method(s), and asks for the sudo/userName password, then I'm able to proceed. I'm trying to configure it, so that you don't need a sudo password, as long as you connect via ssh with an authorized key.

Here are the relevant files and their contents:



auth       sufficient pam_ssh_agent_auth.so file=/etc/security/authorized_keys debug
auth       required   pam_env.so readenv=1 user_readenv=0
auth       required   pam_env.so readenv=1 envfile=/etc/default/locale user_readenv=0

@include common-auth
@include common-account
@include common-session-noninteractive

/etc/security/authorized_keys file information: This file contains 4 ssh-rsa public keys.

-rw-r--r-- 1 root root 1597 Jun 16 16:07 /etc/security/authorized_keys


# This file MUST be edited with the 'visudo' command as root.
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
# See the man page for details on how to write a sudoers file.

Defaults        env_keep += SSH_AUTH_SOCK

Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

And, for sanity's sake, you can see the SSH_AUTH_SOCK is indeed being "passed up the sudo chain" correctly...

printenv | grep SSH


sudo printenv | grep SSH


I ssh into the server via

ssh -A host@ip_address

I'll include any other information that may be helpful, just ask :)

I've been at this for over a day, and I've found dozens of "howtos" to setup PAM sudo authentication using ssh keys, and they're all similar... but I can't find anything that might shine light on why the PAM authentication fails, after successfully contacting/communicating with the ssh-agent.

Thanks in advance!


ssh-add on the client side, was the trick. I'm not an "ssh power user", but this gives me what I need to figure out the root cause. Thanks!

  • ssh-add -L will return something on your local computer and on the remote host?
    – Jakuje
    Jun 17, 2016 at 18:13
  • That did the trick =D Jun 17, 2016 at 18:19
  • Not sure what you mean, but I suspect you don't have the agent running or you don't have the keys added. Is there anything unclear yet?
    – Jakuje
    Jun 17, 2016 at 18:22
  • I simply ran ssh-add on the client, and that was able to load the private key into the agent, which allowed PAM to successfully authenticate on the server. I may still be missing something, but I'm currently researching "what that means." I'm not an "ssh power user", so I may still be missing something, but this gives me a jumping off point to further my research at least :) Jun 17, 2016 at 18:24
  • ssh-add -L on either system, prior to doing that, simply returned The agent has no identities. Jun 17, 2016 at 18:36

2 Answers 2


Configuration is OK, but you need to have some identities in your ssh-agent to be able to authorize the sudo operation. You can verify that your agent has some identities using

ssh-add -L

It should print the public keys in your agent and at least one of them should match the public key on server in /etc/security/authorized_keys.

If the agent does not have any identities, you need to add them on your computer, again using

ssh-add [path/to/key]

and insert your passphrase, if prompted.


I have added this .bashrc on my user that need ssh-agent running, I use it for a special ansible user. I noticed many ssh-agent process and I tried to keep it clean on every login to clean it.

Just to be clear the ssh-agent must run on the server where the connection is made from.


CSSH=$(ssh-add -L 2>/dev/null |grep -c ssh-rsa)
if [ $CSSH -eq 0 ]; then
 pkill ssh-agent
 eval `ssh-agent -s`
 echo "SSH agent already running"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.