ssh-agent: how it works?

Question

I want to try the ssh-agent to login without password (I already know gssapi and pubkey methods, but I want to learn this). On client and server I had enabled AgentForward on ssh_config (client) and sshd_config (server)

On client, I start ssh-agent

eval `ssh-agent`

I add my rsa key

ssh-add

ssh-add -l confirm it works

ssh-add -l
4096 SHA256:******** mysuser@mylocalhost (RSA)

then I login and ask the password

ssh remotehost

ssh-add -l on remotehost confirm it works

ssh-add -l
4096 SHA256:******** mysuser@mylocalhost (RSA)

Now I open another shell, ssh to remote host and..ask again the password. If I logout and login now..ask again the password. What's wrong?

I've also tried to create a new rsa key, add a password, add with ssh-add..and still ask password.

Answer 1

If you start ssh-agent manually in a terminal window, the agent functionality will be available in that window and processes started from it only. To have the agent available in all terminal windows of a GUI session, you would need to have the agent started as part of the GUI session setup.

Your distribution may or may not already have some facilities to allow this: an optional PAM module pam_ssh.so can do this, or Debian and related distributions can enable SSH agent for X11 sessions via /etc/X11/Xsession.options (see man 5 Xsession.options for more info). Other distributions may have other solutions.

Technically, when a SSH agent is started, it creates an Unix socket that allows SSH clients to communicate with the agent, and the environment variable SSH_AUTH_SOCK is used to identify its location. When you use agent forwarding, the sshd of the remote host will create a similar socket and environment variable for the forwarded agent connection.

If you start the agent in one local terminal window, then copy this environment variable to another terminal that is also running a local shell, then you should be able to use the manually-started agent in both terminals. But usually it's better to find a solution for starting the agent as part of the GUI session setup, so that the SSH_AUTH_SOCK environment variable will be already set up and will be automatically inherited by all terminals started in that session.

Note that the administrator of a remote host can disallow SSH agent forwarding, if they feel it necessary.

Answer 2

Solution found.

Before I think (wrong) that ssh-agent "cache" the passphrase so

a) you start the agent

b) enter in remote host

c) the passphrase go in the mysterious "cache"

d) you can enter in the remote host again and the password is not asked because is cached! Totally wrong.

With ssh there are two ways to enter without password

1. single-sign-on using kerberos or AD (which use kerberos)

2. pub-key

ssh-agent can only "forward" the private key, for example:

I start ssh-agent

eval `ssh-agent`
Agent pid 26541

I add the key (I use the default key, but you can specify another key created with ssh-keygen command, with or without password).

ssh-add

To make the thing most clear

local = my local machine
server1 = first remote server
server2 = second remote server

I remote login on server1, NOW because ssh-agent is "forwarded" I can login without type password on server2 from server1, even if server1 don't has the pubkey (which is on local). On server2 I HAVE the key (public) on .ssh/authorized_keys

ssh -A server1 #ask password
ssh server2 #don't ask password, from server1

If ssh-agent is not enabled

ssh -A server1 #ask password
ssh server2 #ask password.

The gif explain better, the user "pino" enter without password from remote host "fedora" to remote host "debian" (to enter without password you must have the pubkey of slack64 copied in $HOME/.ssh/authorized_keys file on host debian in this example), but when it kill the ssh-agent and retry to enter fail (if you remind the password you can enter of course).