57

In order to run ssh-agent I have to use

eval $(ssh-agent)

Why do I have to eval the output of ssh-agent?

Why isn't it designed so that I can just run it?


Note: Backticks (`) removed as they are being deprecated. You can read more about it here for instance.

  • Who says you have to use eval? What is dictating this? A little more context would help. – 0xSheepdog Mar 15 '17 at 21:14
  • 1
    help.github.com/articles/… – jx12345 Mar 15 '17 at 21:16
  • 8
    @0xSheepdog the man page, for a start... – jasonwryan Mar 15 '17 at 21:17
  • Looks like the use cases are documented in the man page. As to "why is it designed a certain way" ... shrug. – 0xSheepdog Mar 15 '17 at 21:22
  • 4
    Reiterating, it's not ssh-agent that is "designed this way", it's unix/linux, because ssh-agent runs in a child process of the shell. Child processes can't modify parent processes. But a function can: because it runs in the current process. So you could write a function: do_set_ssh_agent() { eval ssh-agent; } and that could be run simply as: $ do_set_ssh_agent . But "programs" aren't (typically) installed as "functions" in linux/unix; instead, programs are installed as files, which, as mentioned, run in a child process. (Sourcing scripts is an exception, but ssh-agent is binary.) – michael Mar 16 '17 at 15:55
68

ssh-agent outputs the environment variables you need to have to connect to it:

shadur@proteus:~$ ssh-agent
SSH_AUTH_SOCK=/tmp/ssh-492P67qzMeGA/agent.7948; export SSH_AUTH_SOCK;
SSH_AGENT_PID=7949; export SSH_AGENT_PID;
echo Agent pid 7949;
shadur@proteus:~$ 

By calling eval you immediately load those variables into your environment.

As to why ssh-agent can't do that itself... Note the word choice. Not "won't", "can't". In Unix, a process can only modify its own environment variables, and pass them on to children. It can not modify its parent process' environment because the system won't allow it. This is pretty basic security design.

You could get around the eval by using ssh-agent utility where utility is your login shell, your window manager or whatever other thing needs to have the SSH environment variables set. This is also mentioned in the manual.

  • Thanks, that clearly explains what's going on and I get that, but why is it designed that way rather than designed so running it automatically adds the variables to the environment? Does it add any sort of flexibility??? – jx12345 Mar 15 '17 at 21:35
  • 4
    @jx12345 You could get around the eval by using ssh-agent utility where utility is your login shell, your window manager or whatever other thing needs to have the SSH environment variables set. This is also mentioned in the manual. No external utility can ever set variables in the calling environment. – Kusalananda Mar 15 '17 at 21:36
  • @kusalananda Correct; feel free to add that as an edit. I'm off to bed now or I'd do it myself. – Shadur Mar 15 '17 at 21:37
  • 4
    @jx12345 Because it can add variables to its own environment but it can't add variables to your shell's environment because it's not your shell. – immibis Mar 16 '17 at 2:44
  • 2
    @jx12345 To clarify: If I can add or change env variables to my parent process, I could conceivably affect the parent's parent, and so on up to PID 1. This is called "privilege escalation" and it's a really bad thing from a security standpoint. – Shadur Aug 29 '17 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.