I can do the following:

$local> ssh -A remote1
$remote1> rsync -e "ssh remote2 ssh " remote3:/file .

and this works because keys for both remote1 and remote2 are in my gnome keyring, and remote3 doesn't require a password. However the following fails:

$local> ssh -A remote1 "./scriptOnRemote1.sh"

where scriptOnRemote1.sh performs the exact same rsync command. It produces the following errors:

Permission denied, please try again.
ssh_askpass: exec(/usr/lib64/ssh/ssh-askpass): No such file or directory
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
rsync: connection unexpectedly closed (0 bytes received so far) [Receiver]
rsync error: unexplained error (code 255) at io.c(235) [Receiver=3.1.0]

The difference between the verbose outputs of those two cases starts with

pubkey_prepare: ssh_get_authentication_socket: No such file or directory

Why is this happening?

  • Afaik ssh agent is not forwarded for "commands", only for the shells. – Jakuje Jan 19 '17 at 8:07
  • Why not? I can't find indication of this in the man page. – msyriac Jan 20 '17 at 6:34

Please run ssh-agent after logon to remote1 host.


It's happening because the script you are running does not access your key. It should also not work if you did:

ssh -A remote1 'rsync -e "ssh remote2 ssh " remote3:/file .'
  • I would not be surprised if that were the case (I'll try). But this doesn't help. How can I make the command or script access my key from the forwarded agent? – msyriac Jan 20 '17 at 6:34
  • I'm not sure if it's possible. Here is a guess at something that might work: $local> ssh -A remote1 "export SSH_AUTH_SOCK; ./scriptOnRemote1.sh" (If your script has access to the agent socket, it might just magically work.) – Angelo Jan 20 '17 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.