I'm using Ansible for setting up a remote server and I'm using SSH agent forwarding to
git clone a repository from bitbucket.org to use my local SSH key, because I'm using
sudo I'm preserving the
SSH_AUTH_SOCK environment variable using a file in
/etc/sudoers.d/ directory which contains:
Defaults env_keep += SSH_AUTH_SOCK
Which indeed is making this environment variable available when using
sudo, the problem is when I want to clone as another user
web that doesn't have permission to access the socket file available at
Currently I'm setting the ownership of the socket directory recursively for this user so I don't give
0777 permissions for the socket file.
$ ls -l /tmp drwx------ 2 web web 4096 Aug 7 09:09 ssh-PcIG22W1CM
All of this is done using Ansible but I'm not sharing Ansible code as this issue applies to any other situation.
What is the best practice to share this socket file without giving
rwx permissions for everyone ?