I work with Linux servers in an AWS VPC - there is only one server with a public IP address, the bastion, and to access any of the others, I first log on to the bastion and then on to whichever server I need on the private network. Things have been set up so that I have to use ssh-agent on my work-station, otherwise I get:

$ ssh db3
Permission denied (publickey).

I have set up my according to How to start and use ssh-agent as systemd service?:

$ cat .config/systemd/user/ssh-agent.service
Description=SSH key agent

ExecStart=/usr/bin/ssh-agent -D -a $SSH_AUTH_SOCK


This seems to work - meaning, I can log on to the bastion and on to other servers on that network. However, there are some things I don't get, like:


This should have been /run/user/1000/ssh-agent.socket. I can also see another ssh-agent running:

$ ps -ef | grep ssh-agent
jan       1498  1486  0 09:38 ?        00:00:00 /usr/bin/ssh-agent -D -a /run/user/1000/ssh-agent.socket
jan       1583  1503  0 09:38 ?        00:00:00 /usr/bin/ssh-agent /usr/bin/im-launch /usr/bin/startkde
jan       8466  8450  0 15:26 pts/2    00:00:00 grep ssh-agent

If I export SSH_AUTH_SOCK=/run/user/1000/ssh-agent.socket, I am still able to log on as I need; however, if I add the following to ~/.ssh/config:

Host *
  ForwardAgent yes
  User jan
  IdentityFile ~/.ssh/id_rsa
  AddKeysToAgent yes
  ControlPath ~/.ssh/S.%r@%h:%p
  ControlMaster auto
  ControlPersist yes

This no longer works - I can log on to the bastion, but I get Permission denied (publickey) if I try to log on to anything after that.

So, what did I do wrong?

  • I'm rather late asking this, but do you have any ssh-agent configuration in your shell login scripts, like .bashrc, .profile, .bash_login, etc? – Phil Miller Dec 17 '19 at 2:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.