Does OpenSSH >=7.2 support local-side tilde expansion for remote Unix socket forwarding

Question

I am trying to forward a gpg-agent Unix socket to a remote machine. I have tried the following two versions of the remote forwarding command:

• A: ssh -vvv -N -R ~/.gnupg/S.gpg-agent:~/.gnupg/S.gpg-agent.extra {HOST}
• B: ssh -vvv -N -R ~/.gnupg/S.gpg-agent:/home/{USER}/.gnupg/S.gpg-agent.extra {HOST}

They both report successful remote forwarding after initial ssh connection. However, option A's socket fails with debug1: connect_next: host ~/.gnupg/S.gpg-agent.extra ([unix]:~/.gnupg/S.gpg-agent.extra): No such file or directory when an actual data connection is attempted on the remote machine with gpg-connect-agent /bye while option B's socket works fine.

I want to know whether it is possible to do local home directory expansion with ssh remote forwarding command. If not, why?

Answer 1

The ~ must be expanded by some program. Usually this program is the shell. The sshd daemon doesn't feed the path to a shell and doesn't expand the path.

But you don't need an expansion for the current users home directory as it is the working directory anyway.

Try

ssh -vvv -N -R ~/.gnupg/S.gpg-agent:${HOME}/.gnupg/S.gpg-agent.extra {HOST}

Edit:

This works because the working directory on the host (not on the client) is always the home directory of the target user.

The ssh server doesn't expand ~ of environment variables, but it should be possible to execute code on the host to create a link or symlink to a known location that can be used by the ssh server.

Edited as suggested by Kusalananda

Answer 2

The comment doesn't support newlines, so I had to put these here:

• ssh -vvv -N -R ~/.gnupg/S.gpg-agent:${HOME}/.gnupg/S.gpg-agent.extra {HOST} works
• ssh -vvv -N -R ${HOME}/.gnupg/S.gpg-agent:${HOME}/.gnupg/S.gpg-agent.extra {HOST} works
• ssh -vvv -N -R ~/.gnupg/S.gpg-agent:~/.gnupg/S.gpg-agent.extra {HOST} does NOT work
• ssh -vvv -N -R ${HOME}/.gnupg/S.gpg-agent:~/.gnupg/S.gpg-agent.extra {HOST} does NOT work

As @RalfFriedl explained in his comment (copied here verbatim), "The ${HOME} is replaced by the client shell. This only works if $HOME on the client and $HOME on the server are the same. The ~/ is only expanded at the start of a word, not inside. So ~/XX is $HOME/XX, but XX:~/ is just XX:~/"

For those of you who want to automate this with the RemoteForward keyword in your ssh config file, note that there is no variable expansion there, so you need to use absolute paths. Your best bet is to create a symlink to a known location and use that path for the ssh config file. I'm using the same config file across multiple platform (Ubuntu, Fedora, MacOS, ...), so that's what I'll have to do.